Timeframes Used in PCI DSS Requirements
I get asked all the time what periodic or significant change means in PCI. Here is a breakdown of what the PCI DSS means for each.
| Timeframes in PCI DSS | Descriptions and Examples |
| Daily | Every day of the year (not only on business days). |
| Weekly | At least once every seven days. |
| Monthly | At least once every 30 to 31 days, or on the nth day of the month. |
| Every three months (“quarterly”) | At least once every 90 to 92 days, or on the nth day of each third month. |
| Every six months | At least once every 180 to 184 days, or on the nth day of each sixth month. |
| Every 12 months (“annually”) | At least once every 365 (or 366 for leap years) days or on the same date every year. |
| Periodically | Frequency of occurrence is at the entity’s discretion and is documented and supported by the entity’s risk analysis. The entity must demonstrate that the frequency is appropriate for the activity to be effective and to meet the intent of the requirement. |
| Immediately | Without delay. In real time or near real time. |
| Promptly | As soon as reasonably possible. |
| Significant change | There are certain requirements for which performance is specified upon a significant change in an entity’s environment. While what constitutes a significant change is highly dependent on the configuration of a given environment, each of the following activities, at a minimum, has potential impacts on the security of the CDE and must be considered as a significant change in the context of related PCI DSS requirements:New hardware, software, or networking equipment added to the CDE.Any replacement or major upgrades of hardware and software in the CDE.Any changes in the flow or storage of account data.Any changes to the boundary of the CDE and/or to the scope of the PCI DSS assessment.Any changes to the underlying supporting infrastructure of the CDE (including, but not limited to, changes to directory services, time servers, logging, and monitoring).Any changes to third party vendors/service providers (or services provided) that support the CDE or meet PCI DSS requirements on behalf of the entity. |
Discover more from Chad M. Barr
Subscribe to get the latest posts sent to your email.
