The New PCI-DSS v3.2 and What It Means For You
The PCI Security Standards Council released PCI-DSS version 3.2 with a six-month transition period until October 31, 2016, new best-practice requirements becoming mandatory by January 31, 2018, an extended deadline to June 30, 2018 for migrating from SSL/early TLS 1.0 to TLS 1.2 with interim risk mitigation plans, and expanded multi-factor authentication requirements for all non-console access effective January 31, 2018, all of which organizations subject to PCI compliance must carefully review and implement.
The PCI Security Standards Council released an update to the PCI Data Security Standard (PCI-DSS) at the end of April. The current version of PCI-DSS is now v3.2. If your organization is required to be PCI compliant, here are some key things to know that will help in the transition to the updated version:
1. Sunrise Period
The new standard has a sunrise period of six months. This means if you have a PCI audit scheduled between now and October 31, 2016, you may choose to have the audit conducted against the PCI-DSS v.3.1 (old version), or v3.2 (current version). After October 31, you must use v3.2.
2. New Requirement Deadlines
A number of new requirements are considered best practices (or recommended) until January 31, 2018, after which they become a requirement. Audits conducted before February 1, 2018 may include an auditor’s note regarding your compliance against these best practices, but they will not affect your certification.
3. SSL/Early TLS 1.0 to TLS 1.2 Deadline
The deadline for moving from SSL/early TLS 1.0 to TLS 1.2 has been extended to June 30, 2018 for all service providers. Prior to June 30, 2018, existing implementations must have a formal Risk Mitigation and Migration Plan in place. The PCI Council created a new appendix (Appendix A2- Additional PCI DSS Requirements for Entities using SSL/Early TLS) to give organizations more clarity on what is required in the interim.
4. Multi-Factor Authentication Requirements
Although not a requirement until January 31, 2018, Requirement 8.3.1 will require all non-console access to have multi-factor authentication. Having previously only required multi-factor authentication for remote access to the CDE, this will likely impact most organizations.
If your organization requires PCI compliance, you should perform your own due diligence and read PCI-DSS 3.2 and the Summary of Changes document to ensure you understand the full scope of changes. We recommend reviewing these new requirements and documenting a roadmap for implementation. Some of them could require significant time and budget due to technological or organizational changes required.