2021
Payment
Security
Reportinsights
PCI DSSDSS 4.0
v4.0
white
paper
white paper

VerizonCyber
Verizon Business
Security
Consulting
Professional
ServicesThe latest update to the flagship Payment Card Industry Data Security Standard(PCI DSS) will help organizations ensure that data security controls remain relevant
and more effective in a shifting landscape. It’s the most significant update to the PCI
DSS since its initial release in 2004. If you feel overwhelmed by the amount of
information you need to digest to understand the impact of PCI DSS v4.0 and wantto simplify the complexity with the best curated wisdom available, the Verizon
Payment Security Report (PSR) is essential reading.
Grounded in decades of rigorous research, the PSR provides the definitive guide toinnovating a winning approach to security and compliance within the payment card
industry. The series of reports, dating back to 2010, is perfect for teams across alllines of assurance—from boardrooms and security steering committees down into
the trenches of security and compliance operation teams.
The PSR provides answers to big payment security questions. Keen insights andcommentary clear the fog, answering questions such as:• How do you choose what to prioritize and what to spend time on?
• How do you choose your goals and objectives?
• How do you unravel requirements and remove constraints?
When an organization is doing well, it’s usually because employees are productively
engaged in their work and have a clear sense of direction as to where theorganization is headed. The same is also true for data security and complianceefforts. This only happens when the organization makes a concerted effort tomanage performance, both for the business as a whole and individual employees.
How many in your organization honestly understand and know where to find its
security and compliance goals and objectives? What criteria are you using to ensure
optimization of scarce security team resources? Are you making the right decisions
on your goals, objectives and strategy, and how to deal with constraints?
For many organizations that struggle to maintain PCI security compliance, achieving
strategic success is closer than they think. This especially becomes true when they
follow the PSR’s known wisdom and meticulously crafted steps.
The PSR has helped countless organizations find a way forward with sound security
program innovation, practical frameworks and novel advice. The report’s actionable,
hands-on frameworks help security practitioners build and implement innovative,
robust security business models, operating models and strategies.
Now comes our invaluable advice on PCI DSS v4.0 and how to negotiate the 10th
release of the PCI Standard, one of the most challenging changes in the PCI DSS
to date. Let us help your organization be prepared for the coming change.
The release of PCI DSS v4.0 can have a substantial impact on organizations.
It’s necessary to take the time and steps to update the goals, targets, measures,
ownership, initiatives and other procedures that will change with PCI DSS v4.0.

2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

Table ofcontents
Preparing for PCI DSS v4.0

3

Navigating the transition period
Supporting data security by aligning
your goals
Developing sustainable control
design solutions
Enhanced validation methods
and procedures
Customized approach vscompensating controls
The impact of a customized
approach
Increased control risk:
The Ever Given’s misfortune

Goals, Requirements andConstraints Model: An approachfor complex problem solving

10

The Theory of Constraints and its
relevance to payment security
Opening your window to thebig picture

PCI DSS v4.0
navigational points

14

The necessity and value of control
design templates
Worth repeating2

Preparing for
PCI DSS v4.0
Historic PCI DSS
release timeline
PCI DSS v4.0 is the 10th editionof the PCI Standard. With therelease of PCI DSS v4.0
expected in March 2022, it will benearly nine years since theprevious major update (version3.0) and four years since theprevious interim update (version
3.2.1), which made minor changes
tothe PCI Standard in 2018.

For more than a decade, Verizon has documented compliance trends within the
evolving payment security industry. The PSR has tracked compliance ups anddowns while keeping a finger on the pulse of changing payment security
technology. During that time, consumers and businesses have substantially
increased business activities conducted online. As a result, the number of payment
card transactions has also increased. The capabilities of threat actors continue
to evolve and escalate—skillfully exploiting both old and emerging threats, as well as
weaknesses within payment systems and processes. At the same time, digitaltransformations that heavily involve cloud technologies are introducing new drivers
that impact the payment security industry. This further complicates the role of
CISOs and other security managers and practitioners.

Prior to PCI DSS v4.0, the longest
duration between updates to the
PCI DSS was version 2.0 in
October 2010 and the release of
PCI DSS v3.0 in November 2013.

The release of PCI DSS v4.0 is a much-needed response to these concerns.
It’s the most substantial update to the PCI Standard in 17 years—since the release of
DSS 1.0 in 2004. At first glance, organizations will notice several significant changes
introduced by PCI DSS v4.0. While PCI DSS v4.0 doesn’t alter the fundamental
structure of the PCI Standard, and PCI DSS v4.0 still has the familiar Control
Objectives and 12 Key Requirements introduced in 2006, the new version enacts
multiple changes to reflect the aims of evolving objectives and requirements. This
includes numerous wording changes, updates to existing requirements, several new
requirements and future-dated requirements.

PCI DSS timeline

Why is the PCI Council instituting a major rewrite of the PCI DSS when version
3.2 of the PCI Standard released in 2016 was considered to be fairly mature?

VersionReleaseDecember

1.0

2004

September

1.1

2006

October

1.2

2008

July

1.2.1

2009

October

2.0

2010

November

3.0

2013

April

3.1

2015

April

3.2

2016

May

3.2.1

2018

March

v4.0

These updates reflect significant changes within the payment card industry andaccount for risks in an increasingly complex, ever-changing threat landscape.
In this technology sea change, PCI DSS v4.0 provides new navigation points to
help organizations achieve sustainable control effectiveness across their control andcompliance environments.
PCI DSS v4.0 specifically supports the use of key technologies, such as cloudand serverless computing. Organizations that currently apply compensating controls
to meet DSS requirements may benefit from determining whether
the new PCI DSS customized implementation method is suitable for their specificsecurity needs.
The updated PCI Standard also introduces more flexibility into the wording of the
PCI Standard requirements and adds intent statements. On pages 6 and 7 of thispaper, we explore the two most significant updates in PCI DSS v4.0, which arecontinuous assessments and customized controls and control environments.
This revision of the PCI Standard is considered so significant that between 2019 andmid-2021, the Payment Card Industry Security Standards Council (PCI SSC) fielded
an unprecedented amount of feedback on the PCI DSS v4.0 draft. For past revisionsof the PCI Standard, formal feedback opportunities were limited to a single period
for comments from the PCI SSC participating organizations and assessors. For PCI
DSS v4.0, the PCI SSC expanded the feedback opportunities to maximize
collaboration and stakeholder involvement in updating the PCI Standard.1

1 See PCI Security Standards Council, PCI DSS v4.0: Anticipated Timelines and Latest Updates.
https://blog.pcisecuritystandards.org/pci-dss-v4-0-anticipated-timelines-and-latest-updates
https://www.pcisecuritystandards.org/about_us/press_releases/pr_10242019
https://www.pcisecuritystandards.org/get_involved/request_for_comments
2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights3• Ensure the Data Security Standard continues to meet the security needs of thepayments industry• Create flexibility and support of additional methodologies to achieve security• Address ongoing technology developments in payment systems, mobile,cloud, etc.
• Address ongoing changes in the threat landscape, such as improving protocols
and methods associated with validation• Promote security and compliance as an ongoing process

It’s imperative to start
asking the most importantquestion now:
What steps does myorganization need tostart taking to prepare
for the transition?”

Navigating the transition period

In summary, the most significant reasons for updating the PCI DSS are to:
The date when PCI DSS
v4.0 becomes effective in
2024 will come all too fast.
PCI DSS v4.0 is expected
to be released in March
2022, but compliance withversion v4.0 will not be
required until two years
after its publication date.
Once PCI DSS v4.0 isreleased, an extended
transition period will allow
organizations to transition
to the updated PCI
Standard. In support ofthis, PCI DSS version 3.2.1
will be active for 18 months
after all PCI DSS v4.0
materials are released.
When this transition period
ends, PCI DSS v3.2.1 will
be retired and PCI DSS
v4.0 will become the only
active version. In addition
to the 18-month period
when version 3.2.1 andversion v4.0 will both beactive, there will be an
extra period of time forphasing in new
requirements that are
identified as “future dated”
in PCI DSS v4.0.
Organizations working to
upgrade their complianceenvironments may thinkthey have ample time toresituate their controls.
But with significant
changes, including thecustomized approach
option, they can’t start to2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

4Supporting
data securityby aligning
your goals

The PCI SSC created the requirements to help organizations develop habits ofdata security best practices. The intent of the PCI DSS is for requirements to beconsistently followed to better align, design, prioritize, implement and maintaingoals that will result in an effective, sustainable control environment. This intent
may be more explicit than what was recommended in previous versions of the
PCI Standard.
Since the release of PCI DSS v1.0 in 2004, most organizations continue to struggle
with achieving and maintaining effective, sustainable payment card data security.
Organizations that succeed in maintaining all their PCI DSS requirements yearround—rather than ongoing remediation for the sake of passing an annual
assessment—implement a strategy and design based on sustainable, welldeveloped goals. Once you clarify your goals, you can more easily implement acustom control and validation design.
With this in mind, some organizations successfully transitioned to security as abusiness-as-usual culture. Unfortunately, our 2020 PSR State of Compliance survey
results reveal that nearly three-quarters of organizations (about 72.1%) still focus on
passing their PCI DSS compliance assessment instead of maintaining truly effective
and sustainable control environments. While control failures can still occur withinorganizations with effective control environments, they should be very brief, andrapidly detected and corrected. This requires a capability that is not built into thecontrol environment of most organizations.
PCI DSS v4.0 places increased emphasis on this transition to security as abusiness-as-usual culture, including increased gathering of validation information
over a period of time to encourage continuous security processes.

Developing
sustainable
control design
solutions

Lack of clear goals and a keen strategic defense plan leads to more permeable
security design. CISOs and security managers need to take time to mull overtheir organization’s specific needs and problem-solving solutions rather thanrush straight into implementing the new requirements. Each new and updated
requirement should be examined carefully. Before project managers assign tasks
to resources, they need to understand the scope of the project—both the goals
and constraints.
Well-designed data security and compliance solutions too often become secondaryor tertiary considerations as security planners and technicians scramble to address
staffing shortages and a plethora of email alerts. Annual compliance validation
projects may be perceived as successful simply because controls not in place wereremediated to receive the coveted final annual DSS Report on Compliance (ROC).
This approach falls far short of meeting the intent of the PCI DSS.

2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

5Enhanced
validation
methods andproceduresSome of the major changes introduced by PCI DSS v4.0 are enhanced validation
methods and procedures that evolved from a defined-only approach to also include
an objective-based, customized-approach option. The PCI SSC announced the plan
to introduce these enhanced validation methods and procedures into PCI DSS v4.0
at the 2019 Community meetings.
The traditional defined approach is the familiar method where required security
controls must be implemented when applicable. This traditional method forvalidating PCI DSS won’t be going away with version 4.0. With the defined
approach, requirements need to be met in a very specific manner and validated,sometimes regardless of the actual control outcome, such as whether the control
system in question is actually effective and sustainable. The new customized
approach allows organizations to use security approaches that may differ fromtraditional PCI DSS requirements as long as they can demonstrate that controls
meet the intent of the relevant PCI DSS requirement and can validate
its effectiveness.
Within a PCI DSS compliance assessment, organizations can choose either or bothof the approaches on any of the key requirements. For example, PCI DSS v4.0
allows organizations to take a hybrid approach: They are allowed to meet somerequirements by following the defined approach and other requirements byfollowing the customized approach. Even within a single DSS requirement, thedefined approach and customized approach can be split to meet different aspectsof the requirement as long as the organization meets the security objective of therequirement. However, be aware that some requirements explicitly cannot be met
using the customized approach.

Customized
approach vscompensating
controls

The defined approach
The defined implementation refers to the existing, traditional approach to security
control implementation and compliance validation that has existed since theintroduction of the PCI Standard. The sets of requirements, controls and test
procedures are fairly prescriptive. The PCI Standard includes descriptions of thecontrols that need to be in place and how the validation testing procedures shouldbe met.
The defined approach simply means that organizations follow the current(traditional) requirements and testing procedures as written in the PCI DSS. Thisapproach remains valid. All organizations can continue to benefit from the moreprescriptive direction on how to meet the objectives. Many organizations may notsee any need to follow a customized approach to meet the control objectives.

The customized approach
The customized implementation allows organizations to follow a tailored process
where organizations can custom design security controls or adopt other controls
outside of the familiar list of defined controls. This new customized approach ofvalidating PCI DSS controls focuses on an outcome-based approach rather thana must-implement-based approach. As mentioned earlier, all customized controls
must still meet the stated security objective of the requirement.

2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

6

A customized
approachtypicallyrequiresadditional
documentation
effort for:• Control design, with evidence
that it meets the control
objective and intent• Internal control testing• Control risk
• Control performance• Control effectiveness• Control maintenance• External control compliancevalidation testing procedures

Requirements and validation options in PCI DSS v4.0 were redesigned to focus
on security objectives and support organizations using different methodologies
to meet the intent of PCI DSS requirements. The PCI Standard includes intent
statements that clearly identify the security outcomes that customized
implementations must meet. The control intent statements specify and clarify
what needs to be achieved with greater flexibility in how the organization achieves
the desired security outcomes.
The customized approach’s greater flexibility allows for implementation of security
solutions and technologies that don’t require waiting for the PCI DSS to catch up.
Validation methods focus more on specific security outcomes, giving organizations
the ability to prove the effectiveness of their methods at meeting intended
security outcomes.
This alternate approach allows organizations to custom design and develop security
controls by meeting several criteria:• Determine the controls for a given security objective• Submit detailed documentation to the Qualified Security Assessor (QSA) outlining
the approach to adopt to achieve compliance and demonstrate the effectivenessof the approach• After review of the evidence by the QSA, the QSA makes a final decision on
the effectiveness of the control, based on the analysis of the documentation
submitted

The impact of a customized approach
Customizing security controls should be done in a very structured way that delivers
measurable and predictable outcomes. Organizations with mature control
environments are more likely to embrace the new customized validation approachwith confidence. They should also find it easier to rewrite how their systems canbe tested to validate how they meet the latest PCI DSS requirements.
The new validation method will likely result, at least initially, in additional work fororganizations to develop and prepare documentation, control design, evaluations
and risk assessment data that a QSA will need to evaluate.
Although this new validation approach offers organizations more flexibility in how
the PCI DSS 12 Key Requirements can be met, there is an explicit expectation thatorganizations ensure that each of their customized implementations of PCI DSS
requirements meet respective control objectives and fulfill the intent.
As such, a customized approach requires adopting a robust method for the design
and management of security controls and the maintenance of the control
environment. It requires higher levels of process and capability maturity on control
design, control risk evaluation, control implementation and monitoring.
When choosing to follow the customized approach, organizations that do nothave a robust control environment backed by reasonably mature compliancemanagement processes and capabilities are advised to improve their level ofmaturity and implement changes in small, incremental steps. This avoids making
changes to substantial portions of their control environment, which can lead tounintended consequences.

2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

7

Organizations need to collaborate with the QSA or Internal Security Assessor (ISA)
to agree on and develop tailored testing procedures. Several organizations arelikely to experience unintended consequences from the design and implementationof their customized controls. They need to be aware of blind spots and seekout cause-and-effect relationships between controls, control systems and thecontrol environment.
Allowing organizations to design their own controls and implement them based on
the intent of the requirements can introduce new risks. Organizations need tounderstand the implications and increased responsibility. They need to determine
their capability and competency to design, implement, maintain and monitor
customized controls, as well as their capacity to maintain all the requirements
associated with their approach. The new alternative approach may not be foreveryone. It’s most suited for organizations with fairly mature security, complianceand risk assessment processes in place.
For an overview of capability maturity and metrics, revisit the Verizon 2019 Payment
Security Report, pages 21 to 29.

What are unintended consequences?
The concept of unintended or unanticipated consequences was first coinedby sociologist Robert K. Merton to describe outcomes of a purposeful actionthat are not intended or foreseen. His foundational work “The UnanticipatedConsequences of Purposive Social Action” defines three different types ofunintended consequences:• Unintended benefit: A positive, unexpected benefit (sometimes called awindfall or serendipity)• Unintended drawback: A negative consequence with a positive benefit• Perverse result: A negative consequence with no positive benefit2

2 “Unintended consequences,” Wikipedia. https://en.wikipedia.org/wiki/Unintended_consequences
2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

8Increased
control risk:
The EverGiven’s
misfortune

The perils of overlooking unintended consequences in security design can easily
be underestimated. Making even minor changes to complex systems can resultin unforeseen outcomes. Anticipating and planning for all possible repercussions
in the design process is essential, but complex interdependencies can makepredicting outcomes difficult. Payment security requires a comprehensive,well-researched design approach to avert potentially damaging unintended
consequences. This is especially true when combining the new customized
approach of PCI DSS v4.0 with the multiple drivers of digital transformation, such as
5G, contactless payment, blockchain, artificial intelligence and machine learning.
The March 2021 catastrophe of the container ship Ever Given in the Suez Canal isan apt metaphor for what can happen when design, strategy and planning lack
foresight and coordination. Several converging factors apparently resulted in aperfect storm that grounded the Ever Given for over six days:

The narrow section of thecanal where the Ever
Given—one of the longest
ships in service—became
lodged sideways was
not widened during the2015 Egyptian canalredevelopment project, as
were other canal sections.

3—Robert Burns5

2

1

The best laid plans ofmice and men often
go awry.”

Container ships have atleast doubled in size since
2000, especially in width,with limited regulation
and/or coordination
between the shipping
industry and Suez Canal
officials during that time.3

The hydrodynamics ofwide container ships inshallow, narrow canals
creates less of a gap,
which increases squatting
and bank effects that makeships less maneuverable.4
High winds and a dust
storm on the day of thedisaster apparently
added to loss of control.

When implementing design changes, CISOs and security managers should consider
the “precautionary principle,”6 which emphasizes the burden of proof as being
able to show lack of harm rather than prove harm. The approach is often used bypolicy makers when conclusive evidence is not yet available, and redesigning anddecision-making can result in harm.
“The Precautionary Principle forces us to ask a lot of difficult questions about thenature of risk, uncertainty, probability, the role of government and ethics. It canalso prompt us to question our intuitions surrounding the right decisions to make incertain situations,” according to the Farnam Street blog.7 When designing forchange, such considerations may help organizations avert a costly data breach.

3 “The Impact of Mega-Ships,” The Organisation for Economic Co-operation and Development (OECD), International Transport Forum, 2015.
https://www.itf-oecd.org/sites/default/files/docs/15cspa_mega-ships.pdf
4 Marc Vantorre, et al., “Maneuvering in Shallow and Confined Water,” Encyclopedia of Maritime and Offshore Engineering, Apr 20, 2017.
https://doi.org/10.1002/9781118476406.emoe006 Apr 20, 2017, https://doi.org/10.1002/9781118476406.emoe006
5 “To a Mouse,” Wikipedia. https://sco.wikipedia.org/wiki/To_a_Mouse
6 “Precautionary Principle,” Wikipedia. https://en.wikipedia.org/wiki/Precautionary_principle
7 “The Precautionary Principle: Better Safe than Sorry?” Farnam Street, June 2021. fs.blog/2021/06/precautionary-principle
2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

9Goals, Requirements
and Constraints Model:
An approach for complex
problem solving
Sustainable design requires soundstrategy and a reliable business model.
With the introduction of PCI DSS v4.0
and custom control design, CISOs andmanagers need to clearly understandthe scope of the project—both thegoals and constraints—in relation toeach requirement. Referred to as theGoals, Requirements and Constraints
Model, Verizon believes this approachto complex problem solving is an
essential process for creating efficient,sustainable custom security design.
We discuss this model at length in the2022 PSR.

Applying logical thinking
The majority of organizations do not design and implement control
environments that are truly effective and sustainable. Why is it important tocreate a method or proven process for designing a strategic plan? Some of
the most successful, sustainable products and procedures incorporate aproven process. Dentists adhere to a series of failproof steps when filling
teeth. Builders prepare the land and have a secure method for building afoundation before constructing a house. Why wouldn’t security professionals
apply a method of control design for security systems? What manyorganizations lack is a logical method to deconstruct the complexity of
establishing clear goals and objectives, and the capacity to achieve them.
The application of logical thinking improves the ability to achieve progressin incremental but clear and predictable steps.
The misfortune of the Ever Given can be traced back to a lack of foresightand alignment with strategic goals, regulatory requirements and constraints.
Security managers can benefit immensely from considering this triangular,interlinking model to avoid oversights in the design process.
During compliance validation assessments, conversations between the QSA
and their clients frequently revolve around substantiating the true status of a
PCI DSS requirement. A QSA typically works their way back from the current
condition of the control at the time of the assessment to the decisions andactions the organization took, or failed to take, that contributed to or directly
resulted in the negative outcome. Conversations inevitably journey back to
the organization’s security and compliance goals. In most cases, theevidence of the management of the control environment confirms insufficientattention was given to Goals, Requirements and Constraints. That ultimately
resulted in control failure.
In most cases, this happens due to a combination of weak control design andweak implementation and maintenance that degrades the functional strengthof the control system. Remember that each PCI DSS control always operates
as part of a control system—without exception. Often when failures occur, it
is because controls are not properly evaluated for robustness and resiliencein the context of their dependent and interdependent controls. In addition,
they often lack operational support from a sustainable environment andtherefore are substantially less effective.

2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

10The following questions are worth asking:What are goals?
Goals specify the desired results,
outcomes and destination of
the organization’s mission
and ambitions into specific,
quantifiable terms withmeasurable results. Your primary
security and compliance goalstatements can be quantified inadvance. And their achievement(or nonachievement) should bespecifically measured throughout
the implementation and operationof the tasks and processes along
the journey toward theiraccomplishment.
Clear communication of goals
helps you conduct your day-today operations with a senseof purpose and direction.
It promotes accountability,with team members being
held accountable for their
responsibilities to the collective
team. Good communication lays
a foundation for collaboration
to work toward the achievementof the proclaimed goals.
Setting clear goals for PCI
security compliance can affectindividual performance throughfour mechanisms:• What goals were decided upon and communicated to the organization in regard
to data security and compliance?
• Are they the same goals that members within each of the 4 Lines of Assurance(see page 12, 2019 PSR) will articulate, and should they be asked what are thepriority goals for security and compliance?
• Which percentage of PCI DSS controls across the control environment are truly
and demonstrably effective and sustainable?
• How much success is truly achieved by design versus by luck?
Making the connection between stated goals and lack of compliance sustainability
and effectiveness should be obvious. But for many organizations, it’s not.
It should not require a high degree of diagnostic skills to uncover the relationship.
Organizations are unlikely to hit a target that they are not aiming for. It’s veryrare to encounter organizations that truly embed security control effectivenessand sustainability as an explicit goal to accomplish across their control environment.
As we repeatedly mention in our publications, achieve success (high-quality
outcomes that are predictable, consistent and repeatable) by design, not by luck.
Without specific goals, security and compliance departments are more likely tostagnate, struggle to obtain the investment they need and fail to achieve
meaningful accomplishments.
CISOs and their security teams are understandably busy. The day-to-day
operations always appear to be more pressing and are given higher priority thantaking the time for proper introspection and foresight (Verizon covered this subject
extensively in the 2020 PSR). The proper setting of data security and compliancegoals provides a clear vision for teams and individuals involved in the control
environment or that can influence its security—particularly for the teams withineach of the 4 Lines of Assurance.

• Clear security-compliancegoals direct action andeffort toward goal-related
activities and away fromunrelated activities• Clearly communicated goals
energize employees and leadto higher employee effort• Goals motivate employees toapply their existing knowledge
to attain a goal or to acquire
the knowledge needed to do so• Frequent reminders of goals
affect persistence, andemployees may exert more
effort to achieve high goals

2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

11

The Theory ofConstraints
and its
relevance
to payment
security

The Theory of Constraints (TOC) is a proven process-management methodologythat can help uncover and address the underlying root causes that prevent control
environments from being effective and sustainable. It provides systematic steps tohelp identify the most important limiting factor or constraint that stands in the wayof reaching a desired goal. It then focuses on ways to remove or improve that factor
until it no longer acts as a constraint or obstacle to reaching the goal.
The TOC asserts that any manageable system is limited in its ability to achieve its
goals due to the existence of a small number of constraints. It then seeks to improvethose systems through a scientific approach. Eliyahu M. Goldratt, the creator andauthor of the TOC, describes it as “a process of ongoing improvement” and athinking process that enables people to invent simple solutions to complex
problems.8
Every complex system, including PCI security compliance and data security ingeneral, consists of multiple linked activities. At least one of these linked activities
can act as a constraint upon the entire system and at least one constraint always
exists. In fact, the whole process itself can be the constraint. Other departments,and even senior management, can be considered the constraint. By identifying theconstraint activity that can be considered the weakest link in the chain, theconstraint can then be elevated or broken to the point where it’s no longer thesystem’s limiting factor. Some other part of the system or something external to thesystem will then become the limiting factor. This methodology can also be applied
to PCI DSS compliance environments to break the constraints that prevent control
environments from achieving the required level of effectivenessand sustainability.

Opening yourwindow to thebig picture

The TOC is a prioritization method, a way of looking at a complex system andidentifying, challenging and correcting unexamined assumptions. The TOC helps
you to closely evaluate each step and process within the context of the entire line,
process or organization. This holistic perspective is a key part of the TOC because
it views organizations as a chain of departments and functions.
Organizations have a lot of moving parts. The TOC identifies how you can make thebiggest impact and the most difference to what you are trying to achieve—without
spending a lot of money. There are several tools unique to the TOC that provide
structure and consistency in problem recognition and problem solving, and help
maintain focus on the organization’s goals.
The TOC provides a structure for continuing improvements where they can havethe most impact. The holistic view and continuous search for constraints gives you
better control over your process, and it exposes additional capacity—often without
the need for further investment. In other words, the TOC forces you to use what you
already have instead of immediately spending money on new equipment or moreresources. This is exactly the solution that many organizations need to improve their
PCI security compliance capability. (The 2022 PSR delves into how to effectively
apply the TOC to security programs.)

8 Eliyahu M. Goldratt, “What is this thing called Theory of Constraints and how should it be implemented?” The North River Press, 1999.
2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

12

The TOC presents a better way to findanswers to these basic questions:• Why change? (What is the goal?)• What should change? (Where is the problem and what is the root cause?)• What should it change to? (What is the solution?)• How can we effect the change? (How can it be implemented?)
It provides a powerful approach to help you:
• Clarify your goals and their requirements, and gain clarity of the objectives• Determine the critical success factors branching out underneath the goals(three to five for each goal)• Outline the variable and conditions needed for the system to achieve
the goals• Identify the necessary conditions for each critical success factor9
The concepts of necessary and sufficient conditions help us understandand explain the different kinds of connections between various PCI DSS
security controls, their different states and how they relate to each other. It
also helps to explain the relationships between PCI DSS controls and othercontrols not included in the PCI DSS in order to bring about the required
control effectiveness and sustainability. This will become increasingly
important for organizations opting to follow the custom control designand validation approach.

9 H. William Dettmer, “The Logical Thinking Process: A Systems Approachto Complex Problem Solving,” American Society for Quality Press, 2007.
2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

13

PCI DSS v4.0
navigational points
1.
2.
3.
4.

Do not delay.
Organizations should not delay preparations to meet the requirements of PCI DSS
v4.0 simply because the new PCI Standard hasn’t taken effect. It would be a
mistake to believe that it’s not necessary to start your preparations early, even if
your organization is fully compliant with PCI DSS v3.2.1.

Start strong—meet PCI DSS v3.2.1 requirements.
Start from a position of strength. Determine the extent to which you are, or are not,following the defined approach for each requirement applicable to your cardholder
data environment (CDE). Evaluate the robustness and resilience of your control
systems. Improve your capability to very quickly detect and correct control failures.
Determine if each of the requirements is truly meeting the stated security objectiveof the requirement.

Understand the PCI DSS v4.0 requirements.
Review all the PCI DSS v4.0 requirements carefully, taking note of changed
controls, controls that were removed, new controls, renumbered controls andfuture-dated controls. Ensure that you understand the control objective and intent
of each requirement in the context of the entire PCI DSS. The biggest impact iswithin changes to Key Requirements 12, 11, 10 and 8 (ranked in order of impact).

Choose your control design and compliance validation
option wisely.
Selecting the customized approach may initially require an increased workload
to prepare for the compliance validation of tailored security controls. It could
potentially increase control risk, but also offer a more robust, permanent security
control solution when compared to a defined approach with compensating controlsthat requires documented justification of a business or technical constraint.
(Refer to the 2018 PSR, pages 23 and 41, for examples of how to measure control
effectiveness.) Custom controls, as with traditional defined controls, need to show
consistent operating effectiveness over long periods of time to meet the control
objective and intent without interruption.

2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

14

5.
6.
7.
8.

Take care when selecting a customized approach.
If you opt to follow the customized approach for any portion of your environment,
you need to be prepared to manage the scope of work it requires. Controls should
be designed to be effective and sustainable within the environment they operate in.
And documented evidence should be maintained to substantiate that it meets theintent of the relevant security objective(s). Customization requires a structured
and detailed documented approach. Whoever gets the job of internally reviewing
control effectiveness prior to external validation should be proficient and look atcompetence, maturity and testing as three key elements. This work is needed forthe actual achievement of the task: validating and approving controls.

Use control design and management templates.
The importance of assessing control effectiveness during regular assessments
is obvious. Creating control design documentation in a structured manner isimmensely useful but can be time consuming. Developing and consistently applying
a standardized control template that generates a control design profile for eachrequired security control or control system is a best practice recommendation
for all organizations—particularly when opting to implement a customized control
approach. (See further details at “The necessity and value of control design
templates” on page 16.)

Do early validation of control designs.
Control designs should be shared with assessors (ISAs and QSAs) at the earliest
opportunity during the design process to determine if the controls are acceptable
to meet the related requirements and security objectives. Without thoroughdocumentation that details the what, when and how-to of the design, function,
operation, maintenance and evaluation of controls, the approval of custom control
designs could be delayed.

Prepare for ongoing assessments.
Define the requirements and constraints for your security team to support thedesign, implementation and maintenance of ongoing assessments. This requires
capacity planning and commitment for teams to support this process, to frequently
evaluate, document and report on the control status of the environment throughout
the year. The internal recording of PCI DSS evidence of compliance should be an
ongoing business-as-usual activity.

2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

15

The necessityand value ofcontrol design
templates

Using templates provides substantial benefits for control system improvement,
including the ease, transparency and consistency they provide in deploying,
operating and maintaining controls. Templates assist in the early detection ofcontrol design and control operation issues. They also contribute toward theeffectiveness and strength of the control environment, providing much-needed
perspective on control purpose, function and operational limitations.
In general, a PCI DSS control profile document should be prepared for each control
system and typically include the following 12 items:

1.

Control objective:
Defines the applicable control objective(s) of the control or control system

2.

Control owner:
Assigns ownership and responsibilities

3.

Control function:
Describes the control function, such as management, procedural or technical4.

Control type(s):Describes the applicable control types, such as preventative, detective,corrective or directive

5.

Architecture:
Defines the control architecture, such as system-specific, common or hybrid

6.

Control risk:
Describes key risks that the control mitigates, such as using control-to-risk
matrix or mapping

7.

Control testing:Describes or references control test procedures and standards

8.

Implementation:
Specifies implementation scope, control, procedure implementation anddependencies—listing the primary PCI DSS control and all dependent
PCI DSS controls

9.

Operation:
Documents control operation specifications and defines scope processes,
operational dependencies, supporting processes and control support
requirements, and component impacts on people, systems, processes andthird parties

10. Maintenance:
Defines control maintenance specifications, scope and maintenanceprocesses

11.

Performance metrics:
Provides a list of PCI DSS key performance indicators (KPIs) and other metrics
that can be used to measure control performance

12. Governance:
References related policies, standards, frameworks and regulations1.0

10 Payment Security Report, Verizon, 2018, page 12, for more details on documenting control profiles.
https://enterprise.verizon.com/resources/reports/2018/2018_payment_security_report_en_xg.pdf
2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

162021 Verizon Cyber
Security Consulting PSR
PCI DSS v4.0 insights
Published November 4, 2021

Editorial team:
Lead author
Ciske van Oosten
Coauthor
Cynthia B. Hanson
Lead editor
Cynthia B. Hanson
Contributors
Abdelkrim Aoued Ahmed
Bacha, Claire Lavelle,
John Galt, Michelle Wire,
Mikhail Banguerski,
Sean Sweeney

Payment security
consulting practice:
Managing director, security
Verizon Cyber Security
Consulting
Kristof Philipsen

Maintaining control design profiles can have a positive impact on the qualityof controls and the control environment. Clear control design and operation
specifications establish context and perspective on control performance
expectations; identify and communicate design limitations; and list the operating
and maintenance requirements of key control systems. Without these profiles,
security and compliance teams may lack sufficient direction for early detection
and correction of deviations, which could result in control failure. In general, themore detailed the specification of the design profiles, the tighter the control andmore predictable the performance.
The overall outcome of a managed control design process is to enable and promote
control effectiveness in terms of consistent, complete, reliable and timely operation.

Worth repeating
Control design requires a systematic method. The PCI DSS defines a set of
dependent and interdependent controls that require customization to every uniquecontrol environment in order to be truly effective and sustainable. Without adeliberate and systematic method for control design, the strength of each
implemented control depends mostly on the enthusiasm of the team or person
tasked with its implementation, not the actual measurement of control strengthand sustainability requirements.
Gaps typically exist in areas of control dependency. This point is so important thatit’s worth repeating. The problems associated with organizations implementing
out-of-the-box PCI DSS controls are well known. People assume that controls will
work well and do not need refinement. Yet things often have to go wrong before
organizations take action and actually evaluate control designs and implement
supporting processes to make sure the controls operate as intended and in asustainable manner.

Americas region
Matthew Arntsen

When conducting a compliance validation assessment, QSAs are often surprised at
how organizations willingly tolerate routine security control operation and design
errors. Meanwhile, management will continue to accept low but persistent levels ofcontrol and compliance errors as inevitable and acceptable, even when they are notdifficult to avoid.

APAC region
Ferdinand Delos Santos

Visit verizon.com/paymentsecurityreport for a collection of Payment Security
Report resources.

EMEA region
Loic Breat

About Verizon Cyber Security Consulting

Global lead
Sam Junkin

Global intelligence
Ciske van Oosten
Team email
paymentsecurity@verizon.com

This white paper is a product of Verizon Cyber Security Consulting, a global leader
in the Payment Card Industry practice with a security team of over 600 consultantsin 30 countries. Verizon has one of the largest teams of PCI Qualified Security
Assessors.
Verizon is the longest running PCI services provider in the world, offering services
since 2002. Our payment security practice provides PCI and SWIFT consulting,assessments and program maturity improvement services.
Across its Cyber Security Consulting portfolio, Verizon offers services that help
clients identify, protect, detect, respond and recover from cyber threats while
ensuring compliance with applicable regulations and standards.

© 2021 Verizon. All Rights Reserved. The Verizon name and logo and all other names, logos and slogans identifying Verizon’s products and services are trademarks and service
marks or registered trademarks and service marks of Verizon Trademark Services LLC or its affiliates in the United States and/or other countries. All other trademarks andservice marks are the property of their respective owners. VZWP4250822
2021 Verizon Cyber Security Consulting PSR PCI DSS v4.0 insights

17