The Internal Security Assessor's Guide to Mastering PCI DSS Requirements With Frequencies

This PCI DSS Requirement Is Not In Place

The last thing you want to hear from your QSA is “PCI DSS requirement 1.2.7 is not in place because you haven’t reviewed your network security control rule sets at least once every six months.”

A little embarrassing, right? Maybe you know this requirement has a defined frequency but you forgot to send an email reminder to the network team.

Or maybe you didn’t know. Either way, now you’ve got a control failure.

How will you explain this control failure to senior leadership? Or to your acquirer?

How long will this take to ensure the right processes are in place to not only review the NSC rule sets at least once every six months but to also collect the output of every rule set review?

What about all the other PCI DSS requirements that have defined frequencies and the new ones that have periodic frequencies that you define based on a targeted risk analysis?

As a recovered PCI ISA, I’ve made the rookie mistake and had to explain why a security requirement with a defined frequency failed because the frequency wasn’t adhered to.

Let’s take a look at PCI DSS requirement frequencies, the difference between defined frequencies and periodic frequencies, and finally how Payment Card Assessments Three Pillars of PCI Compliance Excellence can help you.

PCI DSS Requirements Have Frequencies

PCI DSS requirements have frequencies. Some have defined frequencies and some have periodic frequencies. Overlooking requirement frequencies is a costly error that many organizations can’t afford to make. There are 35 requirements with defined frequencies and nine requirements with periodic frequencies (the periodic requirements are all future dated for March 31, 2025).

What's the Difference Between PCI DSS Requirements With Defined Frequencies and Those With Periodic Frequencies?

Defined Frequencies are requirements that have the frequency baked into the requirement. For example, Requirement 1.2.7 states that you must complete NSC rule set reviews at least once every six months. The requirement tells you exactly how often you’re supposed to complete this security task.

Requirements with periodic frequencies are new with PCI DSS v4.0. The periodic frequency gives you a little bit of flexibility that’s backed up by a Targeted Risk Analysis (TRA, also new with v4.0).

You get to determine how often you’re going to perform the required security task.

For example, PCI DSS Requirement 5.2.3.1, if you don’t deploy an anti-malware solution to systems less commonly affected by malicious activity, you define the frequency of periodic evaluations of those system components based on your TRA.

Now let’s take a look at the how Payment Card Assessments’ Three Pillars of PCI Compliance Excellence can help you with the PCI DSS requirements that have frequencies attached to them.

Pillar 1: Automate

If you’re using a project management workflow tool to manage your continuous PCI DSS Compliance program, you can automate the task reminders that you send out based on the PCI DSS requirement frequency.

For example, you’d create the functionality to automatically send the task to complete the network security controls’ rule set reviews once every six months (once every three months if you’re a service provider).

Pillar 2: Educate

If you’re in charge of your PCI DSS Compliance program, the better you are at educating staff who are responsible for maintaining security controls and providing you evidence, the more they know, the better your program will be.

One way Payment Card Assessments can help is through our PCI training and Resource Center. This is subscription based and on demand. We have 3 subscription options available, including a corporate level which allows up to 5 seats for the subscription.

Pillar 3: Operate

When you do the right things well, your PCI Compliance program will be easier to maintain and mature.

PCI DSS requirements that have either a defined or periodic frequency require the right policies and processes to be put in place.

You need to more than just say you review NSC rule sets at least once every six months. You need a process for the review and you need to capture the output of the review.

We’ve got a template that identifies all the requirements with defined frequencies and periodic frequencies.

You can use this template to create the automation for your project management workflow took, educate your staff, and create the processes you need in place to maintain PCI DSS Compliance.

If you’re a Pro or Corporate subscriber to our Resource Center, this template is available to you. Just login and download. You’ll find more templates, including a template for your Targeted Risk Analysis for each requirement with a periodic frequency.

We hope you find our Requirement Frequency template helpful. How will you be using this for your PCI DSS Compliance program?

The Internal Security Assessor’s Guide to Mastering PCI DSS Requirements With Frequencies

This PCI DSS Requirement Is Not In Place

PCI DSS Requirements Have Frequencies

What's the Difference Between PCI DSS Requirements With Defined Frequencies and Those With Periodic Frequencies?

Pillar 1: Automate

Pillar 2: Educate

Pillar 3: Operate

Have You Registered For Our FREE On Demand Masterclass?

Like this:

Like this:

Like this:

Leave a Reply Cancel reply

This PCI DSS Requirement Is Not In Place

PCI DSS Requirements Have Frequencies

What's the Difference Between PCI DSS Requirements With Defined Frequencies and Those With Periodic Frequencies?

Pillar 1: Automate

Pillar 2: Educate

Pillar 3: Operate

Have You Registered For Our FREE On Demand Masterclass?

Share this:

Like this:

Blog Posts

15 Tales From the PCI DSS Compliance Crypt

Share this:

Like this:

Upcoming PCI Workshops in January 2023

Share this:

Like this:

How Mature is Your PCI DSS Compliance Program?

Leave a Reply Cancel reply