Hosted by ControlCase and the PCI Security Standards Council, this 45-minute webinar will cover: History of PCI DSS (including current version 3.2) PCI DSS v4.0 High-Level Changes PCI DSS v4.0 Timeline Deep Dive into notable changes: Promote Security as a Continuous Process Increased Flexibility and Customized Approach Increased Alignment between PCI ROC and PCI SAQ Keep up with the security needs of the Payment Industry and landscape (such as MFA/phishing, etc.) ControlCase Methodology for v4.0 Q&A

2. WEBINAR:
PCI DSS 4.0
YOUR IT COMPLIANCE PARTNER –
GO BEYOND THE CHECKLIST
Download PCI DSS 4.0 Cheat Sheet
Schedule PCI DSS Certification Discussion

3. INTRODUCTIONS
Kishor Vaswani
Chief Strategy Officer
ControlCase
Nitin Bhatnagar
Associate Director, India
PCI Security Standards Council
(PCI SSC))

4. About ControlCase
About PCI SSC
About PCI DSS
History of PCI DSS
PCI DSS v4.0 Update from PCI SSC
PCI DSS v4.0 Update from ControlCase
Deep Dive: Notable Changes
PCI DSS v4.0 Timeline
Get Involved
Agenda
4
1
2
3
4
5
6
7
8
9

5. 1. About ControlCase

6. ControlCase Snapshot
© ControlCase. All Rights Reserved. 6
CERTIFICATION AND CONTINUOUS COMPLIANCE SERVICES
Go beyond the auditor’s checklist to:
Dramatically cut the time, cost and burden from becoming certified and maintaining IT compliance.
• Demonstrate compliance more efficiently
and cost effectively (cost certainty)
• Improve efficiencies
⁃ Do more with less resources and gain
compliance peace of mind
• Free up your internal resources to focus
on their priorities
• Offload much of the compliance burden to
a trusted compliance partner
1,000+ 275+
10,000+
CLIENTS IT SECURITY
CERTIFICATIONS
SECURITY
EXPERTS

7. Solution
© ControlCase. All Rights Reserved. 7
Certification and Continuous Compliance Services
“
I’ve worked on both sides of auditing. I
have not seen any other firm deliver
the same product and service with the
same value. No other firm provides that
continuous improvement and the level of
detail and responsiveness.
— Security and Compliance Manager,
Data Center

8. Strategic Security Partnership for PCI DSS Compliance
© ControlCase. All Rights Reserved. 8
PCI DSS Assessments must be completed by a Qualified
Security Assessor (QSA)
ControlCase is a QSA Company offering the following:

9. PCI DSS PCI SSF PCI P2PE HITRUST CSF
HIPAA ISO 27001 SOC2 NIST 800-53
PCI PIN PCI PA-DSS FedRAMP PCI 3DS
One Audit™
Assess Once. Comply to Many.
Certification Services
© ControlCase. All Rights Reserved. 9
“
You have 27 seconds to make a first
impression. And after our initial meeting,
it became clear that they were more
interested in helping our business and
building a relationship, not just getting
the business.
— Sr. Director, Information Risk & Compliance,
Large Merchant

10. Dashboard of ControlCase One Audit™
© ControlCase. All Rights Reserved.
10

11. 2. About PCI Security
Standards Council
(PCI SSC)

12. About the PCI Security Standards Council
Founded in 2006 as a global
forum for payment card industry
security standards.
• Development
• Management
• Education
• Awareness
12

13. PCI SSC Manages Standards, Not Compliance
PCI SSC Does PCI SSC Does Not
• Develop and maintain PCI
Security Standards and
Programs
• Provide training, tools and
educational resources to
support PCI Security
Standards implementation
and compliance
• Manage or enforce PCI compliance
programs
• Each PCI SSC founding payment
brand has its own PCI compliance
program for the protection of its
affiliated payment card account data
• All compliance related questions
should be directed to the applicable
payment card brand
13

14. 1
4

15. 3. About PCI DSS

16. Payment Card Industry Data Security Standard:
• Established in 2006 by
leading payment card
issuers.
(VISA, MasterCard, American
Express, JCB International &
Discover Financial Services)
• Maintained by the PCI
Security Standards
Council (PCI SSC).
• PCI DSS provides
operational and technical
requirements to protect
cardholder data.
• Currently in PCI DSS
Version 3.2
• PCI DSS Version 4.0 was
just announced
What is PCI DSS?
© ControlCase. All Rights Reserved. 16

17. 12 Requirements of PCI DSS
© ControlCase. All Rights Reserved. 17
CONTROL OBJECTIVES (6 PRINCIPLES) 12 REQUIREMENTS
Build and maintain a secure network
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect cardholder data
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a vulnerability management program
5. Use and regularly update anti-virus software on all systems commonly affected by malware
6. Develop and maintain secure systems and applications
Implement strong access control measures
7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly monitor and test networks
10.Track and monitor all access to network resources and cardholder data
11.Regularly test security systems and processes
Maintain an information security policy 12.Maintain a policy that addresses information security

18. PCI DSS Family of Standards
© ControlCase. All Rights Reserved. 18
 PCI DSS Security of Environments that store, process or transmit account data
 PCI PA-DSS Secures payment applications support PCI DSS compliance
 PCI P2PE Ensures data is encrypted at POI and can only be decrypted by dedicated environment
 PCI TSP Requirements for token service providers for EMV Payment tokens
 PCI Card Production Physical and logical security requirements for card manufacturing and personalization
 PCI 3DS Physical and logical requirements for entities that implement 3DS Payment solution
 PCI PTS – HSM Physical and logical controls for securing HSM
 PCI PTS – POI Protection of sensitive data at POI
 PCI PTS – PIN Security Secure management, processing and transmission of PIN data

19. Data in Question (Credit and Debit Card Data)
© ControlCase. All Rights Reserved. 19
Cardholder Data Includes:
• Primary Account Number (PAN)
• Cardholder’s Name
• Expiration Date
• Service Code
Sensitive Authentication Data Includes:
• Full Track Data
• CAV2/CVC2/CVV2/CID
• PINs/PIN blocks

20. 4. History of PCI DSS

21. History of PCI DSS
Release Dates for PCI DSS
© ControlCase. All Rights Reserved. 21
• PCI DSS v1 - December 2004
• PCI DSS v1.1- September 2006
• PCI DSS v1.2- October 2008
• PCI DSS v2 - October 2010
• PCI DSS v3 - November 2013
• PCI DSS v3.1 - April 2015
• PCI DSS v3.2 - April 2016
• PCI DSS v3.2.1 - May 2018
• PCI DSS v4 - March 2022

22. 5. PCI DSS v4.0
Update from PCI SSC

23. PCI DSS v4.0 RFC Participation
For all PCI DSS
v4.0 RFCs
RFC 1 in 2019
Over 3,000 comments
from 153 companies
RFC 2 in 2020
Over 1800 comments
from 124 companies
RFC 3 in 2021
Almost 1,300 comments
from 87 companies
6,000+
feedback items
200+ Unique
companies
23

24. Goals for PCI DSS v4.0
• Ensure the standard continues to meet the
security needs of the payments industry
• Add flexibility to support different methodologies
being used to achieve security
• Promote security as a continuous process
• Enhance validation methods and procedures
24

25. The 12 Requirements Remain
PCI Data Security Standard – High Level Overview
Build and Maintain a Secure
Network and Systems
1. Install and maintain network security controls.
2. Apply secure configurations to all system components.
Protect Account Data 3. Protect stored account data.
4. Protect cardholder data with strong cryptography during transmission over open,
public networks.
Maintain a Vulnerability
Management Program
5. Protect all systems and networks from malicious software.
6. Develop and maintain secure systems and software.
Implement Strong Access
Control Measures
7. Restrict access to system components and cardholder data by business need to know.
8. Identify users and authenticate access to system components.
9. Restrict physical access to cardholder data.
Regularly Monitor and Test
Networks
10. Log and monitor all access to system components and cardholder data.
11. Test security of systems and networks regularly.
Maintain an Information
Security Policy
12. Support information security with organizational policies and programs.
…but read carefully because the wording may have changed.
25

26. Defined Approach
• Follows current PCI DSS
requirements and testing procedures
• Suitable for entities with
security implementations that align
with current requirements
• Provides direction on how to meet
security objectives
Validating to PCI DSS v4.0
Add Flexibility for Different Methodologies
26

27. Defined Approach
• Follows current PCI DSS
requirements and testing procedures
• Suitable for entities with
security implementations that align
with current requirements
• Provides direction on how to meet
security objectives
Customized Approach (NEW)
• Focuses on the objective of each PCI
DSS requirement
• Entity determines and implements
controls to meet the objective
• Provides greater flexibility for entities
using different ways to achieve a
requirement’s security objective
• Suitable for entities with robust
security processes and strong risk
management practices
Validating to PCI DSS v4.0
Add Flexibility for Different Methodologies
27

28. Compensating Controls and the Customized Approach
Add Flexibility for Different Methodologies
The entity cannot meet the requirement as stated due to
documented technical or business constraints but has
implemented alternative controls to mitigate the risk.
Compensating Controls
The entity has mature risk-management practices
and chooses to implement different controls that
meet the Customized Approach Objective but
does not meet requirement as stated.
Customized Approach
Compensating controls are not an option with the customized approach.
The entity is expected to implement an effective customized control,
without needing to also implement an alternate, compensating control.
Compensating Controls Customized Approach
28

29. Working Together Is Key…
QSA Organization
29

30. Which Entities Can Use The Customised Approach?
Entities that complete a Self-Assessment Questionnaire are not eligible to use a customized
approach
30

31. PCI DSS v4.0: Lots
of New Guidance

32. Cloud and Other
Technologies
• PCI DSS always had a
goal to remain technology
neutral.
• PCI DSS v4.0 includes
refocused requirements
and new objective
statements.
• New Customized Approach
provides flexibility for
organizations using
different ways to meet
security.

33. The First Step to PCI DSS Validation
Annual PCI DSS Scope Confirmation
12.5.2 PCI DSS scope is
documented and confirmed by
the entity at least once every 12
months and upon significant
change to the in-scope
environment
Annual PCI DSS Scope
review
The first step in preparing for a PCI DSS assessment is for the
entity to accurately determine the scope of the review
33

34. PCI DSS v4.0 Implementation Timeline*
2022
Q1 Q2 Q3 Q4
31 March 2024
PCI DSS v3.2.1
retired
31 March 2025
Future-dated new
requirements
become effective
2024 2025
* All dates based on current projections and subject to change
Transition period from PCI DSS v3.2.1 to v4.0
Official Release:
PCI DSS v4.0 with
validation
documents
ISA/QSA
training and
supporting
documents
2023
Transition period from PCI DSS v3.2.1 to v4.0
Implementation of future-dated new requirements
Q1 Q2 Q3 Q4
Q1 Q2 Q3 Q4 Q1 Q2
34

35. 6. PCI DSS v4.0
Update from
ControlCase

36. PCI DSS V4.0 Update
© ControlCase. All Rights Reserved. 36
- No company can certify companies to PCI DSS V 4.0 yet
- PCI Council to offer the first training sometime in June 2022 - after which QSAs can start
assessments under PCI DSS 4.0
- PCI Council has published a list of changes and documentation online. ControlCase will
update customers as we get closer to Q’3 2022. Until then no change to our assessment
process
- Companies will have 2 years to transition to v4.0 but can move earlier as well

37. Goals for PCI DSS v4.0
© ControlCase. All Rights Reserved. 37
PCI DSS v4.0 is the next generation of the standard, and it has the following goals:
 Continue to meet the security needs of the payment industry
 Promote security as continuous process
 Increase flexibility for organizations using different methods to achieve security
objectives
 Enhance validation methods and procedures

38. Critical changes from PCI DSS v3.2.1 to v4.0
© ControlCase. All Rights Reserved. 38
Methodological changes
- Several small updates across the requirements with added Clarification or Guidance
- Introduction of Customized approach to offer additional requirement validation method to meet the
requirement objective
- Introduction of targeted risk analysis for various critical requirements
- For Service Providers - Confirming PCI DSS scope at least once every 6 months and upon significant
change to the in-scope environment
New requirements that may require major efforts/implementations
- Stringent password and MFA (Multi-Factor Authentication) requirements
- Mechanisms to detect and protect personnel against phishing attacks
- Automated technical solution for public-facing web applications that continually detects and prevents
web-based attacks
- Automated mechanisms to review audit logs for all CDE and critical systems
- Internal vulnerability scans via authenticated scanning

39. 7. Deep Dive into
Notable Changes

40. 12 Requirements of PCI DSS v3.2.1 vs. v4.0
© ControlCase. All Rights Reserved. 40
PCI DSS v3.2.1 - 12 REQUIREMENTS PCI DSS v4.0 - 12 REQUIREMENTS
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other
security parameters
1. Install and Maintain Network Security Controls
2. Apply Secure Configurations to All System Components
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
3. Protect Stored Account Data
4. Protect Cardholder Data with Strong Cryptography During Transmission Over
Open, Public Networks
5. Use and regularly update anti-virus software on all systems commonly
affected by malware
6. Develop and maintain secure systems and applications
5. Protect All Systems and Networks from Malicious Software
6. Develop and Maintain Secure Systems and Software
7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
7. Restrict Access to System Components and Cardholder Data by Business Need
to Know
8. Identify Users and Authenticate Access to System Components
9. Restrict Physical Access to Cardholder Data
10.Track and monitor all access to network resources and cardholder data
11.Regularly test security systems and processes
10.Log and Monitor All Access to System Components and Cardholder Data
11.Test Security of Systems and Networks Regularly
12.Maintain a policy that addresses information security 12.Support Information Security with Organizational Policies and Programs

41. Major Updates to PCI DSS v4.0 Requirements Title
© ControlCase. All Rights Reserved.
Requirement 1:
- Changed the requirement title from “Install and maintain a firewall configuration to protect
cardholder data” to “Install and Maintain Network Security Controls”
 Updated the requirement title to reflect the focus on broader “network security controls”. Replaced “firewalls”
and “routers” with “network security controls” to support a broader range of technologies, including the cloud
technology used to meet the security objectives traditionally met by firewalls.
Requirement 2:
- Changed the requirement title from “Do not use vendor-supplied defaults for system passwords
and other security parameters” to “Apply Secure Configurations to All System Components”
 Updated the requirement title to reflect that the focus is on secure configurations in general, and not just on
vendor-supplied defaults.
Requirement 3:
- Changed the requirement title from “Protect stored cardholder data” to “Protect Stored Account
Data”
 Updated the requirement title to reflect the focus on account data. Replaced “Cardholder data” with “Account
data” to apply the data protection requirements to cardholder data and sensitive authentication data, and not
just cardholder data to be receptive to the needs of various parties such as Issuers
41

42. Major Updates to PCI DSS v4.0 Requirements Title
© ControlCase. All Rights Reserved. 42
Requirement 5:
- Changed the requirement title from “Protect all systems against malware and regularly update
anti-virus software or programs” to “Protect All Systems and Networks from Malicious
Software”
 Updated the requirement title to reflect the focus on protecting all systems and networks from
malicious software. Replaced “anti-virus” with “anti-malware” throughout the requirement to
support a broader range of technologies used to meet the security objectives traditionally met by
anti-virus software.
Requirement 12:
- Changed the requirement title from “Maintain a policy that addresses information security for all
personnel” to “Support Information Security with Organizational Policies and Programs”
 Updated the requirement title to reflect that the focus is on organizational policies and
programs that support information security.

43. Goals for PCI DSS v4.0
© ControlCase. All Rights Reserved. 43
- Continue to meet the security needs of the payment industry
Security practices must evolve to continue to meet the security needs of the
payments industry as threats change.
Example:
o Made new updates to multi-factor authentication (MFA) requirements.
o Updated password requirements in-line with current industry best practices.
o Added new e-commerce and phishing standards to address the ongoing threats.
o Updated requirements for Sensitive Authentication Data (SAD) secure handling.
o Added authenticated internal vulnerability scanning requirement for a greater insight into
organizations vulnerability landscape.

44. Goals for PCI DSS v4.0
© ControlCase. All Rights Reserved. 44
- Promote security as continuous process
Promote security as a continuous process as ongoing security is crucial to protect
payment data
Example:
o Clearly assigned roles and responsibilities for personnel working on each requirement.
o Added guidance across requirements to help organizations better understand how to
implement and maintain security.
o Added new reporting option to highlight areas for improvement and provides greater
transparency for report reviewers.

45. Goals for PCI DSS v4.0
© ControlCase. All Rights Reserved. 45
- Increase flexibility for organizations using different methods to achieve security
objectives
Provide more options and different validation methods to increase flexibility for
organizations to achieve security objectives and supports payment technology
innovation
Example:
o Allowed the use of group, shared, and public accounts with exceptions.
o Introduced targeted risk analyses that empower organizations to determine the
frequency of performing certain activities.
o Introduced a new customized approach method to validate PCI DSS requirements, gives
organizations another option to consider innovative methods to achieve their security
objectives.

46. Goals for PCI DSS v4.0
© ControlCase. All Rights Reserved. 46
- Enhance validation methods and procedures
Improve validation methods and procedures with Clear validation and reporting
options to support transparency and granularity
Example:
o Increased alignment between information reported in a Report on Compliance or Self-
Assessment Questionnaire and information summarized in an Attestation of Compliance

47. Compensating Controls vs Customized Approach
© ControlCase. All Rights Reserved. 47
Compensating controls:
• The entity cannot meet the requirement as stated due to documented technical or
business constraints but has implemented alternative controls to mitigate the risk.
Customized Approach:
• The entity has mature risk-management practices and chooses to implement different
controls that meet the Customized Approach Objective but does not meet the
requirement as stated.

48. 8. PCI DSS v4.0
Timeline

49. PCI DSS v4.0 Implementation Timeline*
2022
Q1 Q2 Q3 Q4
31 March 2024
PCI DSS v3.2.1
retired
31 March 2025
Future-dated new
requirements
become effective
2024 2025
* All dates based on current projections and subject to change
Transition period from PCI DSS v3.2.1 to v4.0
Official Release:
PCI DSS v4.0 with
validation
documents
ISA/QSA
training and
supporting
documents
2023
Transition period from PCI DSS v3.2.1 to v4.0
Implementation of future-dated new requirements
Q1 Q2 Q3 Q4
Q1 Q2 Q3 Q4 Q1 Q2
49

50. Q1 2022
• PCI DSS v4.0 and validation documents were published 31 March
• RFC feedback summaries will be available in the PCI portal
• Blog and video content planned to introduce v4.0
Q2 2022
• Translations, supporting documents, and training will be available by end of June
• PCI DSS v4.0 Global Symposium
Q3/Q4 2022
• Engagement, stakeholder support
• Additional guidance document updates

51. PCI DSS v3.2.1 to v4.0 Transition
Q3 2022 Q1 2024 Q1 2025
• *End June onwards
• QSA and ISA Transitional
Trainings Available
• All documentation
released
• Organizations can
commence assessments
against v4.0 using
approved QSAs**
*Based on current timeline
** QSAs must have successfully completed v4.0
training prior to undertaking v4.0 assessments
• *31 March 2024
• PCI DSS v3.2.1
retirement
• PCI v4.0 becomes the
exclusive version for use
• *31 March 2025
• New PCI DSS
requirements with future
dates become effective
51

52. 9. Get Involved

55. Q&A

56. THANK YOU FOR THE OPPORTUNITY
TO CONTRIBUTE TO YOUR IT
COMPLIANCE PROGRAM.
www.controlcase.com
contact@controlcase.com
Download PCI DSS 4.0 Cheat Sheet
Schedule PCI DSS Certification Discussion