Lessons from the leaders
21st January 2025 • Park Plaza Victoria, London
Come the end of March, organisations need to comply with all parts of the new Standard. What have the pioneers discovered and what pitfalls exist for the unwary?
For those who commit to PCI DSS 4.0.1, the benefits extend far beyond card data security
PCI 4.x.x had two categories of new requirements: requirements effective immediately for all PCI assessments after March 31, 2024, and ‘future’ best practices which become mandatory on March 31, 2025. Almost every part of the original PCI DSS 4.0 had at least one 2025 requirement – and here we are!
PCI DSS 4.0.1 is here and presents a complex, multidimensional compliance challenge for end-users, auditors, and vendors.
It, of course, focuses on the payments landscape, on encryption, tokenisation, and authentication.
But it also contains recommendations on broad security challenges such as vulnerability scanning, malware detection, and ways to prevent attacks on browsers and other e-commerce channels. It looks at data-protection from an AI and Cloud perspective. It demands higher standards of automation and continuous monitoring. It modernizes how your organisations have to look at what is in and out of scope, including a strong focus on how you deal with third-parties.
And because the Standard is now a much broader and more detailed blueprint for data and application security, it requires best practice across all facets of cybersecurity: in other words, there’s nothing inherently special about card data. If you want to make sure that your payments infrastructure including cards is secure, then what you are really saying is that you need security across your whole estate. Sure, you can attempt to get card data and payment systems out of scope (harder today than before), but why not just get security for all your data (and other critical processes) right, and then PCI DSS compliance will emerge from your security programme as a result.
So, this year’s event will look at:
- The key requirements of PCI DSS 4.0.1: priorities and resourcing
- Who is moving successfully to PCI DSS 4.0 and how are they doing it?
- Sectoral differences in the approach to PCI DSS compliance
- Building PCI DSS into your broader GRC and regulatory compliance efforts
- From cybersecurity to PCI DSS compliance
- Technology and PCI DSS: mapping the standard to specifics
PCI London will continue our look at PCI DSS 4.0 and the progress compliance teams are making.
Join our real-life case studies and in-depth technical sessions from the PCI compliance leaders at a broad cross-section of organisations and sectors.
