May 15, 2015
What’s new with PCI DSS 3.1?
Written by
Alex Hamerstone
PCI Assessment
Program Assessment & Compliance
We spend a lot of time dealing with the Payment Card Industry (PCI) Data Security Standard (DSS). This should come as no surprise, as for better or for worse, a lot of organizational security programs revolve around compliance with the PCI DSS. For those of you who aren’t PCI Qualified Security Assessors (QSAs), know that the PCI Council is in constant communication with QSAs and works diligently to provide us with additional guidance and direction. Of course, the PCI Council also releases information and clarification to the general public as the need arises. When there are a good deal of clarifications and changes to the DSS, the PCI Council releases a new version. This happened recently when the Council released the PCI DSS 3.1. For organizations that have been working hard to make sure they are ready for PCI 3.0 after getting used to 2.0, a release of a new incremental version may cause a bit of consternation.
The PCI Council provides a summary of changes when new versions are released, and for the differences between 3.0 and 3.1 that summary can be found here: (Note that it is a PDF) https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1_Summary_of_Changes.pdf
So what is new with 3.1? Or, as you may be wondering, what do I as an organization subject to the PCI DSS have to do differently to maintain compliance? The good news is that a lot of the changes are just clarifications. This is a great thing, as the more clarification that is offered in the DSS, the more consistent assessments will be and also it becomes easier for organizations to know what they should be doing.
There are three types of changes as defined by the Council. The following definitions are taken verbatim from the PDF document linked above:
- Clarification: Clarifies intent of requirement. Ensures that concise wording in the standard portrays the desired intent of requirements.
- Additional guidance: Explanation, definition and/or instruction to increase understanding or provide further information or guidance on a particular topic.
- Evolving Requirement: Changes to ensure that the standards are up to date with emerging threats and changes in the market.