New PCI Controls and What You Should Know

This document provides a practitioner-focused walkthrough of forward-dated PCI DSS controls (since v3.2), detailing what organizations—especially service providers—must do to comply with requirements such as defining significant changes and updating documentation, enforcing multi-factor authentication for non-console administrative access to the CDE, documenting cryptographic architectures, detecting and responding to failures of critical security controls, performing segmentation penetration testing biannually, assigning executive accountability for PCI compliance, and conducting documented quarterly reviews of security processes.