How Can TokenEx Help Clients Achieve and Maintain PCI DSS 4.0 Compliance?
With the impending retirement of PCI DSS v3.2.1 at the end of March 2024, many merchants have or are working towards assessing their environment's readiness for their upcoming audits against PCI DSS v4.0. Once past the initial March 2024 deadline, some items shift from best practices into hard requirements in March 2025. Additionally, drafts of 4.0.1 are already in the works and will be entering the Request for Comments period soon.
Starting from scratch?
Don't be daunted by the 360-page PCI DSS v4.0 Standards document. We recommend reviewing the Prioritized Approach outlined by the PCI Security Standards Council (available here) when beginning your journey to PCI compliance. This breaks out the 12 requirements into six milestones to make prioritizing your efforts easier. We still recommend reading the Standard, as detailed guidance is provided for each requirement that is important to understand.
Architecting your systems to prevent PCI data from entering your environment and offloading that risk to a PCI-certified Service Provider like TokenEx can take the lion's share of those 12 requirements off your plate. With solutions such as the Hosted iFrame for PCI data ingestion and the Transparent Gateway for transacting with payment providers or other third parties, you can achieve the lowest amount of PCI controls/responsibilities available to a merchant and be eligible to complete a Self-Assessment Questionnaire (SAQ) A. By employing the TokenEx platform, you can eliminate up to 90% of applicable PCI requirements. You're not limited to just the iFrame and Transparent Gateway, though - TokenEx is an omnichannel accepting and transacting platform, so there are options for tokenizing data within inbound API requests, an API for mobile devices (iOS/Android), batch file tokenization, and much more. TokenEx aims to create a PCI-free bubble around your environment and leverage TokenEx as a cardholder data environment (CDE) Infrastructure-as-a-Service (IaaS) provider to make your audit much easier and faster. Inside that PCI-free bubble, you can leverage the TokenEx Universal Tokens you generate as drop-in replacements for the raw card numbers, as they are 1:1 mapped to the card number itself and have the ability to retain data such as the first six and the last four digits of the card for greater business utility.
Already 3.2.1 compliant and moving towards 4.0?
The good news is that you're almost there, but don't become complacent and put off future dated requirements until the last minute. PCI DSS 4.0 is about modernizing the foundation laid by 3.2.1 to better secure the systems interacting with PCI data and reduce the risk of breaches and fraud. This involves additional steps, such as securing Sensitive Authentication Data (SAD) like CVVs, stronger password requirements, authenticated internal vulnerability scanning, and more. This MRC webinar delivered by TokenEx CISO John Noltensmeyer has an excellent overview of those changes.
If you're using TokenEx, most of these new requirements are already handled. Depending on your implementation, you may need to perform some additional steps to ensure all seven of the new requirements are met, such as payment page tamper detection (11.6.1) and script management (6.4.3). This free PCI audit checklist provides a simple overview of everything you need to prepare for PCI DSS 4.0. HUMAN also has a great blog post that goes over some considerations of those two requirements that go into full effect in March of 2025.
If you're not using TokenEx but are interested in learning more, please request a demo and see how we can ease your PCI compliance burdens. We can help migrate your current data onto our platform and transact with any payment gateway, processor, or third party.
In either case, perform a gap assessment to see where you stand with the new changes in PCI DSS v4.0 and take advantage of the PCI ISA/PCIP resources at TokenEx to help guide you on your journey to compliance.
Additional Resources
Author Bio: Patrick Warme is a Solutions Architect at TokenEx, helping prospects and clients with data security, compliance, and payments. With nearly two decades of experience in the tech industry, Patrick has worn many hats, including high-complexity enterprise application support, security vulnerability evaluations, and software development. Patrick holds several security and technical certifications and is a certified PCI Internal Security Assessor (ISA) and PCI Professional (PCIP).
SaaS Security & Posture Management
10moGreat read for anyone looking to brush up on PCI DSS 4 which goes into effect march 2024