PCI DSS 4.0 Updates

The latest version of the Payment Card Industry Data Security Standard (PCI DSS 4.0) introduces several new features aimed at enhancing payment security, adaptability, and flexibility for organizations. One of the most significant updates is the enhanced validation methods, which allow organizations to blend traditional compliance approaches with customized solutions to better align with their specific security needs. Additionally, PCI DSS 4.0 emphasizes the importance of continuous security, encouraging businesses to integrate ongoing security practices into their overall strategy, making it clear that security is a continual process rather than a one-time effort.

The new standard also introduces greater flexibility with the Customized Approach, enabling organizations to tailor their PCI DSS controls to better fit their infrastructure while maintaining compliance. Key technical upgrades include stricter requirements for encryption, mandating that all cardholder data be encrypted in transit and at rest, even within trusted networks. The standard also strengthens password policies, raising the minimum password length from 7 to 12 characters. Moreover, authentication and data encryption standards have been significantly enhanced, with a stronger focus on securing remote access and cryptographic processes to protect payment and control systems.

When Will These New Requirements Go into Effect?

The new PCI DSS 4.0 requirements will become mandatory starting in March 2025, giving organizations time to adopt and implement these changes to align with the updated standards.

What is Aptify’s Focus in PCI DSS 4.0 Compliance?

Aptify is committed to ensuring that our clients can easily comply with PCI DSS 4.0. Our focus includes:

• Hardcoded Password entries in Config Files: To confirm compliance, auditing and confirming that config files do not use password entries.  This would be documented such that the existing client config files can also be updated to remove password entries and replace it with the alternatives provided.
• Rotation of Database Encryption Keys to maintain robust data security: It is highly recommended that the PAN encryption key must be changed regularly. Aptify recommends changing PAN Encryption key at least annually and additionally it should be retired or replaced at any time when the integrity of the key has been weakened. Please refer detailed PCI documentation around Database Encryption Keys
• Payment Page Script Monitoring for added security in transaction processes. For Bluepay /Cardpointe Hosted iFrame implementation, we are utilizing external iFrame pages for Credit card information entries. This activity would involve securing the iFrame /Html pages by confirming that Aptify cannot make any changes against cardholder details.
• ReCAPTCHA Implementation in e-Business Payment Pages(React): This involves an additional security confirmation by implementing ReCaptcha on eBusiness Payment form. This would help in avoiding automated attacks and fraud detection on payment page.
• Reviewing the Encryption Algorithm: The existing encryption algorithm in Aptify has been reviewed and corrective action will be taken if any encryption algorithm is outdated.
• Migration to Reference Transactions or Hosted Payments to reduce the handling of sensitive payment data on client systems. For Associations using Credit card payment and saving encrypted CC numbers in Aptify db, we highly recommend to change the payment type to reference transaction or Hosted payment method for added security and avoiding saving encrypted CC numbers in db. 

What Can I Do to Prepare?

1. Review and Understand PCI DSS 4.0 Requirements: Ensure that your team is familiar with the new standards, including any updates to existing requirements and the introduction of new controls.
2. Update Security Policies and Procedures: Revise your internal security policies to align with PCI DSS 4.0, particularly in areas such as risk assessment, incident response, and secure software development practices.
3. Assess Infrastructure Compliance: Ensure that your servers, networks, and systems meet the latest encryption, access control, and vulnerability testing standards.
4. Data Encryption and Key Management: Review your current data encryption algorithms and key management practices to ensure they comply with the updated standards.
5. Strengthen Access Controls: Implement multi-factor authentication (MFA) and unique user credentials for anyone accessing sensitive payment data.
6. Conduct Regular Vulnerability Assessments and Penetration Testing: Schedule frequent security tests to ensure your systems remain compliant and secure.
7. Enhance Logging and Monitoring Systems: Ensure you have robust systems in place to detect and alert on any suspicious activity, especially concerning payment processing systems.
8. Review Vendor Management: Ensure that any third-party vendors who store, process, or access payment data are also compliant with PCI DSS 4.0.

To ensure full PCI 4.0 compliance, we recommend consulting with your Compliance and Legal experts. While we’re here to help with platform updates, it’s important to confirm your organization meets all necessary requirements.