Yesterday, the PCI Standards Council posted a document highlighting some of the upcoming changes to the PCI DSS. That document can be found here.
The document is a “teaser” to what is expected to be released in the October timeframe. Two of the roughly four pages speak to the standards development process and feedback cycle. In addition, the Council itself notes that the updates" are relatively straightforward and do not introduce significant changes."
In terms of substantive previews, the following are worth noting:
- Additional guidance is expected for cardholder environment definition and data flow mapping (i.e. scoping)
- Guidance will be provided on virtualization (emanating from the Special Interest Group on this very topic) including how virtual components are defined "in-scope" as well as guidance on specific controls that were traditionally focused on physical hosts.
- Updates to requirement 3.6 for key management to provide additional flexibility for new technologies and evolving ways to manage encryption keys.
- Updates to vulnerability management and application security to reflect the evolving nature of those topics.
As with the last update, the devil will be in the details. The new standards are expected to be published in October and will become effective for all assessments performed starting in January 2011. At this time, there is no reason to believe that these changes will significantly impact the scope and cost of onsite assessments.
As always, if you have any questions, feel free to visit our PCI Resource Center or contact one of our QSAs .
About the Author
Debbie Zaller is a Principal at Schellman & Company,LLC. Debbie leads the SOC 2 and SOC 3 service line and is also an AICPA SOC Specialist. Debbie has over 15 years of IT attestation experience and currently spearheads Schellman’s SOC 2 practice, where she is responsible for internal training, methodology creation, and quality reporting. Debbie was a past member of the Florida Institute of Certified Public Accountants’ Board of Governors and served on the Finance and Office Advisory Committee.
More Content by Debbie Zaller
