PCI DSS v4.0 Core 12 Requirements – Part 1

The PCI  Standards Security Council (PCI SSC) published the latest update to the PCI DSS v4.0 that has significantly shifted the focus on outcome-based. requirements. The core 12 PCI DSS requirements remained unchanged fundamentally with the revised version, however they are now realigned to significantly address how the security controls should be implemented.

PCI DSS v4.0 includes a number of changes and option to implement and validate PCI DSS requirements.

Requirement 1 : Install and Maintain Network Security Controls – Such as Firewalls and any other Network security Technologies such as VPC’s, Security Groups helps the entities to control the traffic between In/Out of their network and Internal network Segments physically or logically.

1. Organizations needs to establish a robust Processes and mechanisms for installing and maintaining network security controls should be defined and communicate with all the stakeholders.
2. Network security controls (NSCs) should be securely configured and maintained regularly.
3. Network access to and from the cardholder data environment is restricted with predefined rules and policies.
4. Network connections between trusted and untrusted networks are controlled.
5. Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.

Requirement 2 : Apply Secure Configurations to All System Components like Firewalls, Routers, Switches, Applications, Databases and any other Network security devices, End User devices etc.,

1. Organizations needs to establish a robust Processes and mechanisms for applying secure configurations to all system components are defined and understood.
2. System components are configured securely and managed securely.
3. If organization using any Wireless environments, then such environments are configured and managed securely.

Requirement 3 : Protect Stored Account Data Like Card Holder Data (CHD) and Sensitive Authentication Data (CHD). Read our FAQ’s.

1. Organizations needs to establish a robust Processes and mechanisms for protecting stored account data are defined and understood.
2. Storage of account data is kept to a minimum as per the business and regulatory requirements.
3. Sensitive authentication data (SAD) is not stored after authorization even if it is encrypted.
4. Access to displays of full PAN and ability to copy cardholder data are restricted.
5. Primary account number (PAN) is secured wherever it is stored.
6. Cryptographic keys used to protect stored account data are secured.

Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.

Requirement 4 : Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Network.

1. Organizations needs to establish a robust Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks are defined and documented.
2. PAN is protected with strong cryptography during transmission.

Requirement 5 : Protect All Systems and Networks from Malicious Software like viruses, worms, Trojans, spyware, and rootkits etc.,

1. Organizations needs to establish a robust Processes and mechanisms for protecting all systems and networks from malicious software are defined and understood.
2. Malicious software (malware) is prevented or detected and addressed.
3. Anti-malware mechanisms and processes are active, maintained, and monitored.
4. Anti-phishing mechanisms protect users against phishing attacks.

Requirement 6 : Develop and Maintain Secure Systems and Software

1. Organizations needs to establish a robust Processes and mechanisms for developing and maintaining secure systems and software are defined and understood.
2. Bespoke and custom software are developed securely.
3. Security vulnerabilities are identified and addressed in timely manner
4. Public-facing web applications are protected against attacks like Man-In Middle attacks etc.,
5. Changes to all system components are managed securely

Read about the  PCI DSS 4.0 Core 12 Requirements – Part 2, here