Changes to the PCI DSS include clarifications and explanations to the requirements, with these clarifications offering improved flexibility to address today’s security challenges in the payment card transaction environment. The new summary document on these changes highlights the key clarifications by requirement. These clarifications will also eliminate existing redundant sub-requirements while improving scoping and reporting requirements. When version 1.2 is released, incorporating existing best practices, supporting documents will also be updated and consolidated. Most importantly, version 1.2 does not introduce any new major requirements to the existing 12 in place since the Council’s inception.

“The Council’s Participating Organizations, through the feedback process, have provided an invaluable service in enhancing the PCI DSS to meet today’s market needs,” said Bob Russo, General Manager, PCI Security Standards Council. “Version 1.2 should be seen as an improvement, not a departure from tried and true best security practices. By distributing a summary of the forthcoming changes, we are ensuring that stakeholders are not taken by surprise by any of the clarifications.”

With the summary of changes to the revision of the PCI DSS, the Council is giving stakeholders guidance on what to expect when version 1.2 is publicly available. The Council is finalizing the changes to the standard and will be providing its Participating Organizations with version 1.2 in early September. PCI SSC Participating Organizations and the Council’s Board of Advisors have been providing feedback on the revisions and the Council is in the final stages of preparing the latest standard and supporting documentation. This follows the established lifecycle process that will ensure that the PCI DSS standard is revised and updated on a two year cycle. PCI DSS version 1.1 was introduced in September 2006.