he PCI Security Standards Council unveiled a summary of changes expected to appear in version 2.0 of the Payment Card Industry Data Security Standard (PCI DSS), which will be published October 28, 2010. Finally, after years of waiting and certainly hundreds of conversations with stakeholders and the card brands, the PCI SSC has release the highlights of the long-anticipated PCI DSS 2.0.
According to the PCI Security Standards Council, the updated PCI standard, which will now be refreshed every three years instead of two, was based on hundreds of pieces of feedback. PCI DSS 2.0 incorporates a stronger emphasis on scoping sensitive data and a more risk-based approach for assessing vulnerabilities. Some believe, however, that the bigger news is not what is included in the revised standard, but what IS NOT included.
“I think the reaction to what’s missing is the most important part of this announcement because it will push the council to move faster on areas they have not yet,” Avivah Litan, vice president and distinguished analyst at Gartner, told SCMagazineUS.com. “A lot of fundamental questions are still unanswered.”
A summary of upcoming changes to the PCI DSS is available online at https://www.pcisecuritystandards.org/pdfs/summary_of_changes_highlights.pdf.
