The New Report Dates in PCI DSS v4.0 Explained

To address some of the past confusion regarding the dating of PCI reports, the PCI Security Standards Council (SSC) has altered the report date methodology for PCI DSS v4.0 to provide more clarity and consistency to this process.

What are the New Report Dates in PCI DSS v4.0?

The two new report dates are:

• Assessment End Date: The last date that evidence was gathered, or observations were made during the assessment.

• Date of Report: The completion date of the Report on Compliance (ROC), which must be no earlier than the date that you and your QSA agree to the final version of the ROC.

So while the date of report is your official compliance date, you can use the assessment end date for tracking your periodic requirements—which means that you can track stale evidence or quarterly scans based on your final evidence acceptance date.

That should come as somewhat of a relief for organizations that have had to deal with the pain points of tracking their quarterly scans and trying to fit them in within 90 days of their ROC date in the past. Now, with the new standard, the time frame relevant to evidence collection stops once the final piece of evidence is accepted by the QSA.

How to Comply with the New PCI DSS v4.0 Report Dates

Understanding these new dates is important when preparing for a PCI DSS v4.0 assessment, so here are a few things you can do to ensure a smooth transition to the new PCI DSS v4.0 reporting:

• Work with your QSA to understand the new dates and how tracking the assessment end date will affect your assessment.

• Allow extra time for your QSA to write the report and for your internal team to review it.

• Why? Because at approximately 400 pages—and that’s without any information being added—the PCI DSS v4.0 ROC template is nearly four times as long as the v3.2.1 template. With so much more report content, your QSA will need to write it just as your time will need more time to review it.

• Keep track of the assessment end date and the date of report so you can ensure you do not miss any annual milestones.

Learn More About PCI DSS v4.0

If you have any questions about the new report dates in PCI DSS v4.0, please contact us, as we’d be happy to help, and be sure to check out our other disseminations on the new standard as well: