[Autogenerated] If you've already taken a look at version four of the standard,
you may have noticed that it looks a little different to
version three At the start of section 15,
you'll find a handy guide to the new parts of the
standard explaining what each part is for.
If we zoom in, here's what the new standard looks like.
Let's take a look at the different parts.
First off is the defined approach requirements,
which is the new way of referring to the traditional prescriptive requirements
you are familiar with from version three alongside the defined approach
requirements are the defined approach testing procedures.
And again, that's the old testing procedure.
When I say the old testing procedure,
the prescriptive testing procedure for the prescriptive
requirement that's going to be tested in the standard way that
it has been since version one of Pc DSS.
Let me say that again.
Together the defined approach requirements and the defined
approach testing procedures are what we are familiar with from
all previous versions of the standard, a requirement and a testing procedure.
Now we get to one of the new parts in the standard,
the customized approach objective.
This is for organizations who decide to use the customized approach to
meet the requirement rather than the defined approach.
We're going to look at the customized approach and how we meet the
customized approach objective in a later module.
Next we have a completely new part and that's the applicability notes,
the applicability notes applied to both the defined
approach and the customized approach.
They helped to interpret the standard in the context of the organization.
So an applicability note might say things like this
requirement is not intended to mean X.
So to prevent a requirement being overinterpreted or that this
requirement doesn't apply in certain circumstances.
One of the things you'll often find the applicability now is whether the
requirement applies to all entities or just to service providers,
And this part is also where a new requirement is marked
as being what we call future dated.
So it doesn't become applicable until one April 2025.
And the final part of the standard is the guidance part.
Now, the guidance part was there in version three of the standard,
but for version four, it's been structured into subheadings,
so it's actually much easier to follow.
Also some of the information that was in the guidance part in version
three has now found its way into the applicability notes,
because it was actually saying how you have to interpret the standards,
it wasn't giving guidance in the guidance.
You generally find a paragraph describing the purpose of the requirement,
it says why the requirement exists.
And you find this helpful when writing a compensating control and
we're doing the customized approach and also,
if you're doing threat modeling,
you might also find some helpful tips of what good practice
to meet this requirement would look like.
But remember this is guidance, it's not part of the standard,
so you wouldn't expect an assessor to enforce the good
practice that's in the guidance column.
Occasionally you will find definitions in the guidance which say how a
word is being specifically used within the requirement.
And you may also find an example of a technology or a
process given in the guidance part.
The final thing you might find in the guidance are
pointers to sources of further information that's
typically going to be external documents,
you might find useful.
Every requirement will have a purpose,
but the rest of the guidance headings will only appear if
they're relevant to that requirement.
What's really important then is to remember that defined approach requirements.
The customized approach objective.
The applicability notes and the defined approach.
Testing procedures are all what are called normative.
In other words, they are the standard,
that's what you have to meet to be compliant.
The guidance column is what is called informative.
It helps you meet the standard,
but it doesn't include the things that you have to do.
Now I know in version three,
the SSC said the guidance column was basically informative,
but as the working group was going through the guidance column,
it realized that occasionally there were things in it that
were actually how to interpret the standard,
which is why things like that have been moved from the informative
guidance to the normative applicability notes