[Autogenerated] Welcome to this Pluralsight course.
What's new in pc IDs S version four my name is john Elliott and I
was one of Mastercard's representatives on the working group that
developed the new version of the standard.
Previously I worked for Visa and was a member of the
working group that made Pc IDs version three.
So I know both versions pretty well in this course we're going to
look at the key things that are new in the standard.
Before I start, there's something very important that I need to say.
This course assumes that you're familiar with version
three of Pc IDs I'm not going to introduce what Pc IDs is
or how compliance programs work.
I'm only going to talk about the changes between version three and version four
and what it could potentially mean for your organization.
We will start off by looking at the timeline when an
organization can no longer validate the version 3.2 point
one and we'll have to use version four, then we'll dive into the standard itself,
starting with the introductory sections and looking
to see what changes there are,
whether they actually have a material effect on how you implement PCs CSS
If you've looked at the standard already you have seen,
there's a new way it's laid out and we'll explore what's mandatory
and what's not mandatory in that new layout.
Then we'll take a quick look at some changes to existing
requirements because these may impact your organization.
Next we'll take a thematic look at the major new requirements in the standard,
then we're going to take a look at the new way of validating Pc DSS
compliance using what's called the customized approach and this is the
major change in Pc IDs S that allows it to be both a prescriptive and
the security objective based standard.
At the same time,
I'm going to highlight some of the things I think you should consider when
you're planning your transition from version 3 to version four.
And then finally,
I just want to pose the question of how many people will actually
have to comply with PCISS version four Because the security of the
payment ecosystem is changing and I'm not entirely sure that
everyone has been asked to comply with version three will be asked
to comply with version four.
First of all.
Then let's take a look at the timeline.
PCs IDs Version four was released on the 31st of March 2022 on that date.
The standard, the report on compliance,
the attestation of compliance and a summary of changes were released.
I prepared this course not long after the standard was released.
None of the self assessment questionnaires were released then and the
accused are expected somewhere around July 2022.
Additionally,
none of the assessors will be trained until probably the middle of 2022.
And so realistically organizations won't be able to be assessed
against version of four until I'm guessing Oh,
the beginning of 2023 Because version four contains many changes.
The PCS sc and the card brands have decided to allow
a two-year implementation phase.
This means that any entity will be allowed to assess its compliance against pc.
IDs s version 3.2 point one.
Right up until the 31st of March 2024 and then from
the first of april 2024 P C I D s s.
Version 3.2 point one cannot be used.
And the only version that anyone will be able to
assess against is version four point X.
Yeah,
I'm saying version four point X because by then I expect there to be in
probably 4.01 release because they're about to be some small areas in
the standard requiring a very minor release.
However, most of the new requirements in pc kids our future dated.
That means that although they're included in the standard,
they won't be assessed against until after 31 March 2025.
Let me say that again.
When you have an assessment, you have to use a version of the standard.
That's current.
The assessments up to 31 March 2024,
this means you can be assessed against either version 3.2.1
or version four whichever you choose.
However, If your assessment is on or after one April 2024,
you will have to be assessed against version four but
excluding most of the new requirements.
And just so it's completely clear,
you don't have to comply with version four from 1 April 2024.
You just need to comply with the new standard when you are
assessed against IT assessments before the 31st of March 2025
will be assessed against version four.
But without testing compliance with the new future
dated requirements in the standard,
Assessals on or after one April 2025 will be assessed
against the whole of the standard, including all of the new requirements.
I don't know when you're watching this course,
but if you're watching it in 2022,
you might think that March 2025 is a long time away.
However,
some of the new requirements might take you a couple of years to
implement and so now really is the time to be thinking about how
they impact your organization.
And we'll talk more about that in the last module of this course.