FAQ #1270 Diff

In PCI DSS version 3, Requirements 6.5.10, 8.5.1, 9.9, 11.3, and 12.9 are considered ?best practices?"best practices" until June 30th, 2015, after which they become requirements.   This is intended to give organizations additional time to implement these new requirements without falling out of compliance.

 
In 2014, organizations that have not yet implemented these future-dated requirements may validate to either version 2 or version 3 of PCI DSS.   Organizations that have implemented these requirements would validate them as part of a version 3 assessment.   Both the ROC Reporting Template and Self-assessment Questionnaire (SAQ) for PCI DSS version 3 include options for reporting whether a future-dated requirement has been included in the assessment.


It is strongly recommended that organizations start implementing these new requirements as soon as possible. However, they are not required to be in place until July 1st, 2015.


It should also be noted that organizations working to implement the updated penetration testing requirements (Requirement 11.3) in version 3 will still need to meet the version 2 penetration testing requirements until version 3 is in place.