The short answer is not entirely. However, web application and API protection (WAAP) solutions check off many of the technical compliance aspects of the latest Payment Card Industry Data Security Standard (PCI DSS).
WAAPs can address bot detection, application security, API protection, DDoS mitigation, firewall, and many other aspects of PCI DSS. The figure below is an abstract view of how a single integrated solution, such as a such as a WAAP solution, can address many risks to the payment card ecosystem.
PCI DSS 4.0, published on March 31, 2022, is one of the most important and impactful releases to date. This release addresses some of the most critical architectural, control, and design risks organizations face when accepting and processing payment card transactions. It requires compliance with 64 new requirements by March 31, 2025. Thirteen require compliance immediately for organizations opting for version 4.0 assessments.
However, some good news is that they’re related to improved documentation. The broad scope of this release has caused 90% of PCI DSS decision-makers to be concerned with meeting the deadline.
This version marks the first time PCI allows an organization to decide how best to comply with the standard. However, the burden of proof will be on the organization to demonstrate the effectiveness of its approach. PCI has also moved from snapshot control compliance to continuously monitoring security posture to prove risk management effectiveness and outcomes. Cybersecurity and fraud management are emerging as a fused discipline as an acknowledgment that the two are inexorably linked. This release will challenge organizations to transform their current approach to protecting cardholder data and focus on risk outcomes, not passing assessments.
PCI DSS version 4.0 allows organizations to phase compliance over two years in three stages. Owing to the complexity of changes, the PCI Council allows one more year than previously for versions 2.0 to 3.0. The first stage is effective now and includes 13 new requirements that must be included for all organizations accessing version 4.0 of the required PCI DSS Report on Compliance or Self-Assessment Questionnaire. Stage 2 takes effect on March 31, 2024, upon the retirement of the current 3.2.1 version. Beginning April 1, 2024, all assessments must be under PCI DSS 4.0. The third and final stage requires the 51 best practices in place by April 1, 2025.
To learn more about how WAAPs can aid in complying with the PCI DSS version 4.0, check out my latest report, Understanding and Preparing for PCI DSS 4.0. I would love to hear how you intend to comply with the new version of PCI DSS; drop me a line here to share your thoughts. If you want to keep up with my blogs on related IT security issues, go here.
