Within this newsletter we want to inform you about the current publications of the PCI Council and other news from the IT compliance sector. The most important topics are:
1. PA-DSS v3.0 and 3.1 Lifecycle Dates
2. Does PCI DSS apply to bank account data?
3. PTS POI v4.1 released
PA-DSS v3.0 and 3.1 Lifecycle Dates
While PA-DSS became effective on the date of its release, new application submissions to PA-DSS v3.0 will be accepted until 31 August 2015. Applications being validation against PA-DSS v3.0 which are “in queue” (that is, submitted with invoice paid) by the 31 August 2015 cut-off date, will have an additional 90 days (November 30, 2015) to complete the validation process. All application submissions after 31 August 2015 must be to PA-DSS v3.1.
No Impact and Low Impact changes to applications assessed against PA-DSS v3.0 will continue to be accepted until 28 October 2016 but must be accompanied by Attestation of Validation (AOV) v3.1 in which application vendors are required to attest that the application only uses or supports the use of cryptographic protocols that meet PCI SSC’s definition of strong cryptography.
High Impact changes to applications assessed against PA-DSS v3.0 will only be accepted after 31 August 2015 if validated according to PA-DSS v3.1.
Does PCI DSS apply to bank account data?
PCI DSS applies for the protection of cardholder data (PAN, cardholder name, service code and expiration date) and sensitive authentication data (full track data from the magnetic stripe or equivalent data on the chip, CAV2/CVC2/CVV2/CID, and PIN/PIN block), from a payment card representing one of the founding PCI payment brands (American Express, Discover, JCB, MasterCard, or Visa).
Bank account data, such as branch identification numbers, bank account numbers, sort codes, routing numbers, etc., are not considered payment card data, and PCI DSS does not apply to this information.
However, if a bank account number is also a PAN or contains the PAN, then PCI DSS applies.
It should also be noted that some bank account numbers, such as IBAN (International Bank Account Number) may contain up to 10 PAN digits. If the number of PAN digits contained in an IBAN, or any other account number, is in excess of the truncation formats defined by the particular payment brand (see FAQ 1091), then PCI DSS applies.
Even if PCI DSS does not apply to a particular account number containing elements of PAN, it is strongly recommended that the account number be protected to avoid unauthorized persons from being able to derive the full PAN from the account number.
PTS POI v4.1 released
The PIN Transaction Security Working Group has updated the POI Modular Security Requirements, the supporting Derived Test Requirements and the POI Modular Evaluation Vendor Questionnaire. These documents are aimed at manufacturers of ATMs and POS devices.