5 Updates from PCI SSC That You Need to Know
As payment technologies evolve, so do the requirements for securing cardholder data.
September 25, 2019
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0fbda98c629ded82/64f0d4243a12317152237009/1.jpg?width=700&auto=webp&quality=80&disable=upscale)
More than 1,300 stakeholders from across the payments industry convened in Vancouver this month for the Payment Card Industry Security Standards Council's (PCI SSC) North America Community Meeting.
Key topics on the agenda included a new security standard for contactless payments on off-the-shelf mobile devices, development of the next major version of the PCI Data Security Standard, and a soon-to-be released new version of the PCI standard for point-to-point encryption (P2PE). Also announced at the Vancouver event was a new Security Framework that will guide the PCI Security Council's standards and decision-making processes in the years ahead.
Much of the focus of the initiatives is on extending PCI security standards to new and emerging payment technologies such as contactless payments on mobile devices. Under the new Strategic Framework, stakeholders will have more of a say in how standards for payments security evolve in coming years. Increasingly, the focus is on ensuring organizations meet the intent and objectives of the PCI security standard and not just on whether they have the recommended controls in place or not.
For well more than a decade, all organizations handling payment card data, both directly and indirectly, have had to comply with PCI DSS. The standard — developed by MasterCard, Visa, American Express, Discover, and JCB — prescribes a set of security requirements for protecting credit and debit card data.
The controls are designed to ensure that organizations handling payment card data have secure networks and systems, secure payment applications, strong access control mechanisms, and a robust vulnerability management program and that they regularly test and monitor their networks for security issues. Numerous companies that have experienced payment card data breaches in recent years have had to pay fines and face other consequences for failing to comply with PCI requirements.
Here are five items that were on top of the agenda at the North America Community meeting in Vancouver.
Starting October, the PCI Security Standards Council will start accepting applications from companies and individuals that are interested in becoming payment software security assessors under the Council's new Software Security Framework (SSF).
The assessors will be responsible for ensuring that vendors are compliant with the requirements of the Secure Software Lifecycle standard and that their software meets the requirements of the Secure Software standard.
PCI SSF is a set of standards and programs for payment card security that will replace the current Payment Application Data Security Standard (PA DSS) in 2022. The SSF will incorporate elements of PA DSS as well as standards and approaches for a broader array of payment software, technologies, and development methods. The Council has described the SSF as embodying a new approach for ensuring the security of new and emerging payment software and channels.
"Goals for the Software Security Framework include allowing for more agility in the security testing, expanding the potential types of applications that go through validation, increasing application developer awareness of payment security design and accountability," says Troy Leach, CTO of PCI SSC, in comments to Dark Reading.
Covered entities will eventually need to ensure their software is validated to SSF requirements if they want to remain compliant with PCI requirements. But that won't happen immediately. To minimize disruption, the Council will run the SSF in parallel with PA-DSS for some time. Applications will continue to be accepted for PA-DSS validation through mid-2021, according to the Council.
The PCI P2PE standard has for sometime governed security requirements for technologies and services that organizations use for end-to-end encryption of cardholder data. The goal is to ensure that no sensitive cardholder data passes in unencrypted form through a merchant's point of sale system. P2PE has widely been recognized as a way for organizations to reduce the scope of their PCI compliance obligations.
In December 2019, the Council will publish Version 3.0 of the P2PE standard, featuring changes more to the underlying program itself rather than to specific compliance requirements. Starting with P2PE v3.0, the Council will allow point-to-point encryption providers to validate individual components of their technology instead of having to validate them as a complete set.
According to the Council, Version 3.0 of P2PE would double the number of component providers that can validate against the standard. The listing of individual components will make it easier for P2PE technology provider to be aware of and to select validated components for integration, and will give organizations more choices, it noted in a blog last week. "Entities that provide elements of an overall solution will be able to more easily demonstrate their role to protect integrity of the key management and confidentiality of data," Leach says. "This includes organizations such as [Key Injection Facilities] and Certification Authority's/Registration Authorities," he says.
A new Strategic Framework will guide the PCI Security Standard Council's decision-making process going forward. The Framework does not change the SSC's mission so much as expand it to include new and emerging payment channels.
At its core, the Framework is focused on increasing industry participation and knowledge around payment security, evolving payment security standards, ensuring that new payment methods are properly secured, and increasing standards consistency and alignment. The Council will use the Framework to prioritize the standards and programs it develops and how it will deliver these initiatives, according to PCI SSC executive director Lance Johnson.
"For example, the new request-for-comments process recognizes the importance of industry participation in the standards development process in order to continue to provide resources that address industry needs and challenges," he says.
A new Strategic Framework will guide the PCI Security Standard Council's decision-making process going forward. The Framework does not change the SSC's mission so much as expand it to include new and emerging payment channels.
At its core, the Framework is focused on increasing industry participation and knowledge around payment security, evolving payment security standards, ensuring that new payment methods are properly secured, and increasing standards consistency and alignment. The Council will use the Framework to prioritize the standards and programs it develops and how it will deliver these initiatives, according to PCI SSC executive director Lance Johnson.
"For example, the new request-for-comments process recognizes the importance of industry participation in the standards development process in order to continue to provide resources that address industry needs and challenges," he says.
More than 1,300 stakeholders from across the payments industry convened in Vancouver this month for the Payment Card Industry Security Standards Council's (PCI SSC) North America Community Meeting.
Key topics on the agenda included a new security standard for contactless payments on off-the-shelf mobile devices, development of the next major version of the PCI Data Security Standard, and a soon-to-be released new version of the PCI standard for point-to-point encryption (P2PE). Also announced at the Vancouver event was a new Security Framework that will guide the PCI Security Council's standards and decision-making processes in the years ahead.
Much of the focus of the initiatives is on extending PCI security standards to new and emerging payment technologies such as contactless payments on mobile devices. Under the new Strategic Framework, stakeholders will have more of a say in how standards for payments security evolve in coming years. Increasingly, the focus is on ensuring organizations meet the intent and objectives of the PCI security standard and not just on whether they have the recommended controls in place or not.
For well more than a decade, all organizations handling payment card data, both directly and indirectly, have had to comply with PCI DSS. The standard — developed by MasterCard, Visa, American Express, Discover, and JCB — prescribes a set of security requirements for protecting credit and debit card data.
The controls are designed to ensure that organizations handling payment card data have secure networks and systems, secure payment applications, strong access control mechanisms, and a robust vulnerability management program and that they regularly test and monitor their networks for security issues. Numerous companies that have experienced payment card data breaches in recent years have had to pay fines and face other consequences for failing to comply with PCI requirements.
Here are five items that were on top of the agenda at the North America Community meeting in Vancouver.
About the Author(s)
You May Also Like
CISO Perspectives: How to make AI an Accelerator, Not a Blocker
August 20, 2024Securing Your Cloud Assets
August 27, 2024