Two days left to PCI 1.2!

With the official release now two days away, several stakeholders now have been privy to version 1.2. Considering two years has gone into revising the Payment Card Industry Data Security Standard (PCI DSS), this prescriptive IT security standard hasn’t changed that much.

What most merchants need to know is “How will v1.2 impact my organization?”  The good news is that some requirements have been altered to better meet existing risk management procedures.

Requirement 1 eases firewall rules reviews from quarterly to every six months. The patching specification in Requirement 6, now reads “….that a risk-based approach may be used to prioritize patch installation” instead of patching every 30 days. A thorough approach to patching takes longer than 30 days in order to fully test, prioritize, and ensure a robust deployment process. The change allows for countermeasures such as Host and Network Intrusion Prevention technologies to apply a virtual shield to systems until patches can be deployed.

Finally, the anti-malware requirement has been updated to include “all operating system types.” This may place more strain on organizations as they will be required to put in place a series of compensating controls especially for older systems.

Tags: PCI