PCI DSS version 4.0
The new version of the standard contains updates that affect:
- Permissible ways of validation;
- The requirements; and
- Additional clarification.
What's new in PCI DSS 4.0?
Basically, the standard remains the same - it provides protection of payment data from evolving risks and threats. 4.0 aims to support organizations that use custom security solutions that meet PCI DSS requirements. This will provide more flexibility to achieve individual security objectives and allows entities to design their own security controls to achieve it.
PCI DSS v4.0 promotes security as a continuous process. The new version clearly defines the roles and responsibilities for each requirement, adds guidelines for implementing and maintaining security, and adds an option to communicate. Validation methods and procedures have also been improved.
Stricter authentication requirements have been introduced. As the payments industry gradually shifts to the use of cloud services, stricter payment authentication and access control standards are needed. PCI DSS 4.0 introduces:
- Multifactor Authentication (MFA) for all accounts that have access to the cardholder's data, not just administrators;
- Change the passwords for accounts used by applications and systems, at least every 12 months and in case of suspicion of compromise;
- Use strong passwords for accounts with at least 15 characters, including numbers and letters. PCI DSS requires future passwords to be compared to the list of known bad passwords;
- Review of access rights at least once every 6 months.
PCI SSC has partnered with Europay, Mastercard and Visa to implement the use of the 3DS Core Security Standard during transaction authorization.
PCI DSS 4.0 addresses the wider use of cardholder data encryption, including with regard to networks. This is a response to the spread of malicious code that, once embedded in the network, gains access to cardholder data when transmitted over the network.
Contact us for more information and consultation.
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
