{"id":507137,"date":"2024-01-26T10:00:00","date_gmt":"2024-01-26T15:00:00","guid":{"rendered":"https:\/\/www.commvault.com\/?p=507137"},"modified":"2024-01-25T13:39:41","modified_gmt":"2024-01-25T18:39:41","slug":"compensatory-controls-and-compliance-for-pci-dss-v4-0","status":"publish","type":"post","link":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0","title":{"rendered":"A Strategic Resilience Approach with Commvault Cloud: Compensatory Controls and Compliance for PCI DSS v4.0"},"content":{"rendered":"\n

In the dynamic landscape of cybersecurity, businesses face an ongoing challenge to protect sensitive data, particularly payment card information. Compliance models such as the Payment Card Industry Data Security Standard 4.0 (PCI DSS v4.0) are developed to encourage and enhance data security for organizations that handle sensitive customer data. Within this standard the PCI DSS 4.0 Requirement 6<\/a> emphasizes the critical need to develop and maintain secure systems and applications, recognizing that vulnerabilities in companies\u2019 IT are regularly exploited by malicious actors. It mandates the installation of applicable vendor-supplied security patches within one month. <\/p>\n\n\n\n

The Patchwork Challenge<\/h2>\n\n\n\n

On one hand, patching requirements appear trivial and necessary in today’s world. On the other hand, organizations face constraints from testing schedules and complex infrastructure including tool sprawl and legacy systems that make timely vulnerability management a nearly impossible mission for many. As a result, PCI compliance requirements, such as the one-month patching timeline, impose a crucial challenge to companies.<\/p>\n\n\n\n

Even after the implementation of patches, businesses are exposed to threat actors that identify new vulnerabilities and exploit them in zero-day attacks, especially in the modern age of generative AI. Organizations inherit cyber risk from IT vulnerabilities, but vendors are responsible for promptly discovering, disclosing, and fixing them.<\/p>\n\n\n\n

Research<\/a> reports that 42% of vulnerabilities are continuously exploited even after a patch is issued, with an average critical exposure time for threats (the time between disclosure and patch availability) of approximately nine days. Two years before the disclosure of the MOVEit vulnerability<\/a>, signs of experiments for exploiting it were observed in the recent MOVEit cyberattack<\/a>.<\/p>\n\n\n\n

Resolving PCI DSS Challenges with Compensatory Controls\u00a0<\/h4>\n\n\n\n

Though PCI DSS v4.0 has stringent requirements, it does allow some exceptions to give organizations flexibility and applicability. The one-month patch rule is one with some wiggle room: \u201cCompensating controls may be considered when an entity cannot meet a PCI DSS requirement explicitly as stated due to legitimate and documented technical or business constraints but has sufficiently mitigated the risk associated with the requirement through the implementation of other, or compensating, controls.\u201d<\/p>\n\n\n\n

With risk mitigation in mind the imperative of the standard is to build cyber resilience into your payment card systems. To help address this challenge, Commvault\u00a9 Cloud, powered by Metallic AI, offers a comprehensive approach on a single platform that goes above and beyond conventional methods. Let’s explore in a short journey how Commvault Cloud helps you:<\/p>\n\n\n\n

    \n
  1. Mitigating risk for known and unknown vulnerabilities<\/strong>
    Our data-minded cyber deception solution Commvault Cloud\u2019s Threatwise capability brings modern ransomware protection and early warning detection of vulnerability exploitation attempts to companies of every size. The proactive defense shields your production data against zero-day and silent threats by spotting malicious intent and activity along the path to your data. It does this by strategically blanketing vulnerable assets, critical instances, and hybrid environments with intelligent sensors that send out highly accurate early warning signals with actionable threat intelligence across the organization. The patented technology enables prompt risk remediation, redirection of the threat, and exposes silent attacks with its unique capabilities including:\n
      \n
    1. Tailored threat detection to industry specific risk factors (i.e., sensors mimicking Point of Sale (POS) systems)<\/li>\n\n\n\n
    2. Custom sensors unique to your business<\/li>\n\n\n\n
    3. Strategic sensor placement recommendations to improve cyber resilience<\/li>\n\n\n\n
    4. Preconfigured reports aligned to the PCI DSS standard <\/li>\n\n\n\n
    5. Automated alerts with actionable insights to key stakeholders and security tools, such as your SIEM<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n\n\n\n
        \n
      1. Keep your backup data clean<\/strong>
        Utilize artificial intelligence (AI) to fight AI-driven attacks by surfacing zero-day and polymorphic malware targeting your backup instance with Commvault Cloud Threat Scan. This allows you to respond and recover clean data faster. Uncover abnormalities and predict threats before they infect your backups to help achieve and exceed recovery objectives.
        <\/li>\n\n\n\n
      2. Identify data risk and governance factors<\/strong>
        Commvault Cloud Risk Analysis helps find, categorize, and act on sensitive data in secure data repositories and active data sources in seconds. Risk Analysis helps you stay ahead of data sprawl and over exposure to keep sensitive data protected and avoid exfiltration of data.
        <\/li>\n\n\n\n
      3. Secure, monitor, and response<\/strong>
        Commvault Cloud\u2019s Security IQ provides visibility across data instances, so you always stay cyber ready. Continuously bolster security posture, identify data risks in real time, and remediate them to stay ahead of evolving threats. Integrations with SIEM and SOAR can further automate response to cut your time to react.<\/li>\n<\/ol>\n\n\n\n

        Commvault Cloud and PCI DSS v4.0<\/h4>\n\n\n\n

        Commvault Cloud enables you to adopt a cyber resilience approach to help meet central requirements within the PCI DSS v4.0 (including Req2, Req3, Req7, Req10). The platform ensures secure configurations across all system components, safeguards stored backup account data, restricts access to cardholder backup data, and implements robust logging and monitoring. Comprehensive security control such as identification and access management controls, security posture overviews, best-in-class encryption standards, and extensive documentation capabilities are available across all system components. <\/p>\n\n\n\n

        To learn more about our cutting-edge technology and recent real-world threat detection case studies contact us<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

        Achieve PCI DSS v4.0 compliance seamlessly with Commvault Cloud. Learn how our single-platform solution addresses the one-month patching rule with compensatory controls, offering risk mitigation for vulnerabilities, clean backup data, data risk identification, and robust security monitoring.<\/p>\n","protected":false},"author":164,"featured_media":507138,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_custom_css":"","_custom_js_footer":"","_page_background_color":"","_remove_from_search":false,"_dark_mode":false,"_light_footer_mode":false,"_sidebar_form":{"id":"","name":"","cta":"","redirect":""},"_alert_notification_bar":{"show":true,"bg_color":"","content":"","call_to_action_label":"","call_to_action_link":""},"_footer_cta":{"show":false,"title":"","subtitle":"","cta_text":"","cta_link":"","background":{"id":0,"url":""}},"_cmv_customer_logo":{"id":0,"url":""},"_jetpack_memberships_contains_paid_content":false,"i18n_hreflangs":"","footnotes":""},"categories":[206],"tags":[],"cmv_author":[1444],"class_list":{"0":"post-507137","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-data-protection-2","8":"cmv_author-guy-waizel","9":"entry"},"yoast_head":"\nA Strategic Resilience Approach with Commvault Cloud: Compensatory Controls and Compliance for PCI DSS v4.0 | Blog<\/title>\n<meta name=\"description\" content=\"Achieve PCI DSS v4.0 compliance seamlessly with Commvault Cloud. Learn how our single-platform solution addresses the one-month patching rule with compensatory controls, offering risk mitigation for vulnerabilities, clean backup data, data risk identification, and robust security monitoring.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A Strategic Resilience Approach with Commvault Cloud: Compensatory Controls and Compliance for PCI DSS v4.0\" \/>\n<meta property=\"og:description\" content=\"Achieve PCI DSS v4.0 compliance seamlessly with Commvault Cloud. Learn how our single-platform solution addresses the one-month patching rule with compensatory controls, offering risk mitigation for vulnerabilities, clean backup data, data risk identification, and robust security monitoring.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0\" \/>\n<meta property=\"og:site_name\" content=\"Commvault - English - United States\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Commvault\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-01-26T15:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-01-25T18:39:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/01\/PCI-DSS-v4.0-Blog.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"rijnashpk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@commvault\" \/>\n<meta name=\"twitter:site\" content=\"@commvault\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"rijnashpk\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"A Strategic Resilience Approach with Commvault Cloud: Compensatory Controls and Compliance for PCI DSS v4.0 | Blog","description":"Achieve PCI DSS v4.0 compliance seamlessly with Commvault Cloud. Learn how our single-platform solution addresses the one-month patching rule with compensatory controls, offering risk mitigation for vulnerabilities, clean backup data, data risk identification, and robust security monitoring.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0","og_locale":"en_US","og_type":"article","og_title":"A Strategic Resilience Approach with Commvault Cloud: Compensatory Controls and Compliance for PCI DSS v4.0","og_description":"Achieve PCI DSS v4.0 compliance seamlessly with Commvault Cloud. Learn how our single-platform solution addresses the one-month patching rule with compensatory controls, offering risk mitigation for vulnerabilities, clean backup data, data risk identification, and robust security monitoring.","og_url":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0","og_site_name":"Commvault - English - United States","article_publisher":"https:\/\/www.facebook.com\/Commvault\/","article_published_time":"2024-01-26T15:00:00+00:00","article_modified_time":"2024-01-25T18:39:41+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/01\/PCI-DSS-v4.0-Blog.png","type":"image\/png"}],"author":"rijnashpk","twitter_card":"summary_large_image","twitter_creator":"@commvault","twitter_site":"@commvault","twitter_misc":{"Written by":"rijnashpk","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0#article","isPartOf":{"@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0"},"author":{"name":"rijnashpk","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/person\/e8397b26dc620551baacfb35c66ec01d"},"headline":"A Strategic Resilience Approach with Commvault Cloud: Compensatory Controls and Compliance for PCI DSS v4.0","datePublished":"2024-01-26T15:00:00+00:00","dateModified":"2024-01-25T18:39:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0"},"wordCount":834,"publisher":{"@id":"https:\/\/commvault-new.go-vip.net\/#organization"},"image":{"@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0#primaryimage"},"thumbnailUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/01\/PCI-DSS-v4.0-Blog.png","articleSection":["Data Protection"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0","url":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0","name":"A Strategic Resilience Approach with Commvault Cloud: Compensatory Controls and Compliance for PCI DSS v4.0 | Blog","isPartOf":{"@id":"https:\/\/commvault-new.go-vip.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0#primaryimage"},"image":{"@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0#primaryimage"},"thumbnailUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/01\/PCI-DSS-v4.0-Blog.png","datePublished":"2024-01-26T15:00:00+00:00","dateModified":"2024-01-25T18:39:41+00:00","description":"Achieve PCI DSS v4.0 compliance seamlessly with Commvault Cloud. Learn how our single-platform solution addresses the one-month patching rule with compensatory controls, offering risk mitigation for vulnerabilities, clean backup data, data risk identification, and robust security monitoring.","breadcrumb":{"@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0#primaryimage","url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/01\/PCI-DSS-v4.0-Blog.png","contentUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/01\/PCI-DSS-v4.0-Blog.png","width":1200,"height":628},{"@type":"BreadcrumbList","@id":"https:\/\/www.commvault.com\/blogs\/compensatory-controls-and-compliance-for-pci-dss-v4-0#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.commvault.com\/"},{"@type":"ListItem","position":2,"name":"A Strategic Resilience Approach with Commvault Cloud: Compensatory Controls and Compliance for PCI DSS v4.0"}]},{"@type":"WebSite","@id":"https:\/\/commvault-new.go-vip.net\/#website","url":"https:\/\/commvault-new.go-vip.net\/","name":"Commvault - English - United States","description":"","publisher":{"@id":"https:\/\/commvault-new.go-vip.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/commvault-new.go-vip.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/commvault-new.go-vip.net\/#organization","name":"Commvault","url":"https:\/\/commvault-new.go-vip.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/logo\/image\/","url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/03\/logo-commvault-horizontal.jpg?quality=80","contentUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/03\/logo-commvault-horizontal.jpg?quality=80","width":1200,"height":628,"caption":"Commvault"},"image":{"@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Commvault\/","https:\/\/x.com\/commvault","https:\/\/www.instagram.com\/commvault\/","https:\/\/www.linkedin.com\/company\/commvault","https:\/\/www.youtube.com\/user\/commvault","https:\/\/en.wikipedia.org\/wiki\/Commvault"]},{"@type":"Person","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/person\/e8397b26dc620551baacfb35c66ec01d","name":"rijnashpk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/37c838d5879db9a6fc3632ac17fcc4a8?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/37c838d5879db9a6fc3632ac17fcc4a8?s=96&d=mm&r=g","caption":"rijnashpk"}}]}},"jetpack_featured_media_url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/01\/PCI-DSS-v4.0-Blog.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts\/507137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/users\/164"}],"replies":[{"embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/comments?post=507137"}],"version-history":[{"count":1,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts\/507137\/revisions"}],"predecessor-version":[{"id":507145,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts\/507137\/revisions\/507145"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/media\/507138"}],"wp:attachment":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/media?parent=507137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/categories?post=507137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/tags?post=507137"},{"taxonomy":"cmv_author","embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/cmv_author?post=507137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}