FRAMINGHAM, Mass. – A new version of the PCI Data Security Standard scheduled for release later this year is likely to attract more attention for what it leaves unaddressed rather than what it changes, analysts say.
That assessment is based on a preview of proposed changes to the standard for securely processing financial transactions released Friday by the PCI Security Standard Council, the body which administers the Payment Card Industry Data Security Standard (PCI DSS).
The preview suggests that most of the changes in PCI DSS 2.0, which is scheduled for release in October, are going to be incremental in nature and unlikely to cause major headaches for companies covered by PCI.
Much of the emphasis in the new version appears to be on fleshing out and clarifying existing guidelines rather than on introducing new ones.
But the new standard appears to leave largely untouched several issues where companies are looking for more guidance from the PCI Council, analysts said.
“The standard’s revisions seem like a positive step and don’t seem to impose a lot of extra work and unreasonable requirements on complying organizations,” said Avivah Litan, an analyst with Gartner.
“But what is glaringly lacking is progress on the hard and most important issues, including the implications of adopting alternative technologies,” on PCI compliance requirements, she said.
According to Litan, many Gartner clients are trying to understand whether their adoption of new technologies such as chip cards, tokenization and end-to-end encryption will limit the scope of their compliance requirements, Litan said.
But most of the clarifications around such issues have been left for Special Interest Groups (SIG) to figure out, she said. “These SIGS are not being held to any particular deadlines and it’s still unclear how their reports will fold into PCI requirements,” she said.
The PCI Security Council’s guidance around virtualization technologies is going to be another area that is going to be closely watched, said James Paul, senior vice-president, delivery at Trustwave, which provides PCI assessment services for many of the largest retailers in the country.
“Overall, there are no big surprises here. There is certainly nothing in the proposed list that our clients will have a lot of heartburn addressing,” Paul said.
Today’s preview indicates that the new standard will offer new guidance on how the use of virtualization technologies will impact PCI compliance requirements, he said. But a lot will depend on the amount of detail that is provided in the new version of the standard, he said.
“I’m encouraged that they are giving some additional guidance around virtualization,” Paul said. “But we just can’t get enough concrete details fast enough.”
Many Trustwave customers want to know today if their use of virtualization technologies will increase the scope of their PCI requirements, he said. “It’s an emerging technology. There are a lot of questions around it,” he said. “There are a lot of people somewhat hesitant to dive into it until they see some guidance.”
Robert Russo, general manager of the PCI Security Council said that the planned changes to the PCI DSS standard are in response to feedback from companies covered by the standard.
The fact that there aren’t too many substantive changes to the standard is a “testament of the strength of the standard and of its maturity,” Russo said. The fact that more than 55 per cent of the feedback received by the council came from companies outside the U.S is also an indication of just how global the standard has become, he said.
Today’s preview is designed to give covered entities a flavor of the changes contained in PCI DSS 2.0 and to give them an opportunity to comment on it, he added.
Russo said the more significant changes in PCI DSS include one that requires companies to identify all locations on their network where cardholder data resides, and another that requires companies to implement centralized logging of Web applications.
Also significant is a new risk-based approach for addressing vulnerabilities that will allow companies to consider their specific circumstances when remediating vulnerabilities.
