The surge in cybercrime activity since the outbreak of the COVID-19 pandemic has been hard to ignore. The finance industry, in particular, has been a prime target for cybercriminals due to its high value and potential for a big payday. In fact, over 60% of global financial institutions with over $5 billion in assets were hit by cyberattacks in 2022. With the payments sector experiencing a record-breaking 157 billion non-cash transactions in the US alone, it has become a major threat target.
To combat this, the PCI Standards Security Council, led by major players in the payments card space, has unveiled the newest version of its Data Security Standards (DSS) v4.0. With the previous guidance, DSS v3.2.1, set to expire in 2024, businesses and vendors accepting card payments are working hard to meet the March 2025 compliance deadline for v4.0. However, adapting to the new expectations of v4.0 is proving to be a challenge due to the complexity of new technologies and evolving threats.
So, what’s new in PCI DSS v4.0? The updated guidance, which spans over 350 pages, introduces numerous best practices and enhancements. It now requires businesses to implement multifactor authentication on all accounts accessing cardholder data and mandates employee cybersecurity training. However, meeting these new compliance requirements and ensuring overall adherence to the guidance can be daunting, especially for businesses aiming to become DSS compliant for the first time.
Here are three foundational steps that businesses can take to become compliant:
1. Establish a baseline and review guidance pillars: It’s crucial to have a firm grasp of end-to-end compliance from the start. Familiarize yourself with the 12 pillars of PCI DSS v4.0, which cover aspects like network security and data transmission cryptography. Determine which PCI DSS level your business falls under to understand the specific requirements for compliance.
2. Determine the role of technology in your compliance efforts: v4.0 allows businesses to leverage technology to achieve and demonstrate compliance. The compliance technology industry has evolved significantly since v3.2.1, and regulators now expect technology to be part of an organization’s compliance strategy. Consider using emerging technologies like the cloud and SaaS tools for network monitoring and vulnerability testing to meet v4.0 expectations.
3. Embrace flexibility and dynamism: Cybersecurity guidance will likely come at a greater frequency in the future. Build cybersecurity strategies that are flexible and adaptable to new payment technologies and threats. Prioritize robust preventative and detectable cybersecurity measures, such as anti-malware software and threat hunting, to remain compliant and provide a secure experience for customers.
PCI DSS v4.0 is a significant milestone for the cybersecurity health and performance of the payments card industry. However, businesses must also go beyond compliance and engage in proactive cybersecurity strategies to stay ahead of adversaries and establish trust with consumers.
To stay updated on the latest cybersecurity threats, vulnerabilities, data breaches, and emerging trends, you can subscribe to receive daily or weekly email newsletters.