Those challenges involved in protecting PCI data in a multi-tenant environment, "may make it impossible for some cloud-based services to operate in a PCI DSS compliant manner," the document noted. "Consequently, the burden for providing proof of PCI DSS compliance for a cloud-based service falls heavily on the cloud provider, and such proof should be accepted only based on rigorous evidence of adequate controls."
The guidance document should sort out some of the prevailing confusion surrounding the applicability of PCI in virtual settings, said Jim Huguelet, an independent PCI consultant.
"This is the best document that the PCI Security Standards Council has written to date in terms of really thinking about the breadth of the [issue] and then providing specific recommendations and best practices," Huguelet said.
The clarifications surrounding hypervisors and mixed-mode environments are particularly useful because of the uncertainty that has surrounded both topics for sometime, he said.
"Traditionally there's been a fair degree of ambiguity as to how PCI applied to virtual environments," added Richard Park, product manager at Sourcefire. "The guidelines make it more explicit how PCI is applicable to virtualization."
As examples, Park pointed to sections in the guidance document that spell out how firewalls need to be used to provide segmentation between different workloads and how specialized intrusion detection and intrusion prevention tools might sometimes be needed to monitor traffic in virtual environments.
Also key are recommendations on how companies need to separate server administration and security administration tasks in virtual environments to ensure appropriate segregation of duties.
"Virtualization was one of the biggest areas left untouched [by PCI rules]," said Avivah Litan, an analyst with Gartner. "It was unknown territory for a lot of people."
"This is one of the more helpful documents," Litan said. "This really fleshes things out."
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org .