Review v3.2 standards and ensure the report is up to date with it.

[rickmanelius]

This is a bit behind. Stubbing this out as a meta issue to see what needs to be addressed before updating and releasing a new version.

[greggles]

Hi Rick! This has been on my mind, so thanks for filing the issue :)

Relevant reading PCI_DSS_v3-2_Summary_of_Changes.pdf.

[rickmanelius]

Hey @greggles! I've been somewhat derelict in my duties, but transitioning over to the DRUD team has freed up more time for community work :)

[greggles]

OK, I just finished reading that summary of changes PDF and I'm not sure any of it requires changes to the report. It could be good to just review the report and give it a quick update to include 3.2, but it's possible there's nothing else to add.

[rickmanelius]

3.2 Change Review

These are sections that might warrant a little extra scrutiny or a potential call out to those building/hosting/managing Drupal sites.

• New requirements change around the quantity of controls specified. For example https://github.com/rickmanelius/drupalpcicompliance/blob/master/DrupalPCICompliance.md#self-assessment-questionnaire mentions 326 and 347 items.
• 6.4.6 This issue mentioned change management policies. This may be relevant to call out for non SAQ A solutions.
• 8.1.5 This touches on vendors with login access. This may be relevant to call out for non SAQ A solutions.
• 10.8, 10.8.1 "New requirement for service providers to detect and report on failures of critical security control systems." This seems relevant for those willing to take on PCI compliance from a hosting perspective.
• 12.11, 12.11.1 "New requirement for service providers to perform reviews at least quarterly, to confirm personnel are following security policies andoperational procedures."
• Appendix A3 New Append. New Appendix with additional requirements for entities using SSL/early TLS, incorporating new migration deadlines for removal of SSL/early TLS.

3.1 Change Review

Technically the current white paper has been peer reviewed to v3.0. So we need to review the 3.0 to 3.1 changes as well (see attached).

These are sections that might warrant a little extra scrutiny or a potential call out to those building/hosting/managing Drupal sites.

• 2.2.3: Need to sweep and ensure consistent with SSL and TLS terminology/versions.
• 8.1.4: Clarified that inactive user accounts must be removed/disabled within 90 days.
  PCI_DSS_v3-1_Summary_of_Changes-English (1).pdf

[rickmanelius]

Alright, this is far too out of date. I'm just going to make a hail mary attempt to get a new version out the door by end of May and that should suffice for a few years.

[shaigluskin]

Have you thrown the hail Mary yet? I'm interested in progress.