PCI DSS v4.0 and the Targeted Risk Analysis

With the dozens of changes the PCI DSS v4.0 presents, it’s easy to get lost in the myriad of requirements, changes to wording and all-around confusing nature of the DSS. When it comes to Targeted Risk Analyses, or TRAs as we lovingly call them, they pose a particular risk of confusion when considering what approach to take when completing the ROC. 

This brief will aim to summarize some key things to consider when determining whether your organization will take the defined or customized approach, and how to deal with frequency requirements specifically. 

‍

‍

Targeted risk analysis involves identifying and assessing specific risks that may impact your organization's cardholder data environment (CDE). It requires your organization to conduct a thorough evaluation of systems, processes, and vulnerabilities to determine potential threats and their likelihood of occurrence. This analysis enables businesses to prioritize security measures based on identified risks.

If and when your organization decides to utilize a customized approach, it’s important to understand that Appendix E1 and E2 will be used to account for the approach, conduct the risk analysis and implement the controls necessary to meet the requirement. 

There is, however, a different form that is to be used for frequency requirements outlined in 12.3.1. The DSS gives your organization the freedom to self-define the frequency of several activities, so long as those activities are defined and accounted for using a TRA but it’s not the standard Appendix E2 that is used! It’s a stripped-down version specific to frequency requirements! 

‍

Get the full PCI DSS v4.x Sample Template here and PCI DSS v4.x Targeted Risk Analysis Guidance here.

‍

This PCI DSS v4.x TRA template is to be used for all frequency requirements where your Organization has the autonomy to decide how often a task will be performed.

Those requirements are:

• 5.2.3.1
• 5.3.2.1 (not a typo)
• 7.2.5.1
• 8.6.3
• 9.5.1.2.1
• 10.4.2.1
• 11.3.1.1
• 11.6.1 *In some cases
• 12.10.4.1

CyberCrest hopes that this helps your organization save valuable time, avoiding wasted efforts completing appendix E1 and E2 when they don’t have to be. If you need further assistance or have any questions on PCI DSS v4.0, contact us.

‍

‍