PCI SSC publishes AI security guidance
PCI SSC published an information supplement on security considerations for AI systems, covering AI deployment, defending against malicious AI use, and how PCI standards apply to AI.
- Framework
- PCI DSS
- Who it concerns
- Entities that deploy or use AI systems in payment environments.
What changed?
Each point with the sentence from the source that says it.
When AI is used, it should be considered no different from any other form of technology when scoping the PCI requirements that may apply.
In general, when AI is used, it should be considered no different from any other form of technology when scoping the PCI requirements that may apply.
Emphasis is placed on the importance of frequent, if not continual, monitoring and management of vulnerabilities when defending against AI-powered vulnerability discovery.
When considering defending systems in the age of AI-powered vulnerability discovery, emphasis is placed on the importance of frequent, if not continual, monitoring and management of vulnerabilities.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Vulnerability Management Policy
Review vulnerability management procedures to ensure frequent or continual monitoring and management of vulnerabilities, as emphasized for defending against AI-powered attacks.
- Information Security Policy
Review information security policies to consider AI systems as any other technology when scoping PCI requirements.