New PCI Lifecycle Gives Retailers A Way To Game The System
Written by Walter ConwayA 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.
As we reported back in mid-April, the PCI Council has, this week, officially announced that the new versions of both PCI DSS and PA-DSS will move to three-year lifecycles. Because the PCI assessment cycle is only 12 months, this timing raises an interesting possibility for a retailer to game the system.
The change represents an increase of one year over the current two-year lifecycle. It should be good news for retailers and application developers alike. Changes to the standards will come less often, and there will be more time for comment on proposed changes.
This week’s release is the first in a series of announcements and research papers expected over the summer as the PCI Council rolls out its revised version of the PCI DSS in advance of the PCI Community Meeting in Orlando in September.
Looking at the new PCI DSS and PA-DSS lifecycles, there are no bombshells. Instead there are some interesting nuances for retail CIOs. For one thing, the sunset date for the old requirements is stretched out. Retailers also have more time to implement changes.
Under the current lifecycle, the revised standards would be published in October and became effective immediately. This timing is not very useful for retailers because it coincides with the fourth quarter freeze on system changes. It also means retailers have only six months (from January to June 2011) to implement the new standard. The new lifecycle, on the other hand, gives retailers a year.
The new three-year lifecycle means the present (version 1.2) DSS won’t be retired until December 2011. This change gives retailers as many as 15 months to implement and validate under the revised DSS. Because the PCI assessment cycle is only 12 months, this timing raises an interesting possibility for a retailer to game the system. A retailer could, for example, validate compliance against the outgoing 1.2 version of the DSS in the fourth quarter of 2010 and use that same version again in the fourth quarter of 2011, just beating its retirement date. The implication is that such a retailer would not have to validate against the new version until the fourth quarter of 2012.
This quirk of timing is more of a curiosity than a flaw resulting from the extended lifecycle. I don’t think anyone would recommend this strategy and, as a QSA, I would argue very strongly that retailers–for their own sake–comply with the latest version of PCI as soon as possible. Additionally, because no major changes are expected to the new version, I don’t think a retailer would gain very much by waiting.
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
