Not much of a contest actually, as CMS hasn’t officially moved the HIPAA bar at all. Maybe the HITRUST alliance will have an impact in healthcare, but probably not, unless they have some regulatory backing and an actual audit function.

GLBA and the FFIEC InterAgency Guidelines (and the Information Security Handbook) have seen extensive changes over a longer period of time. 

OK, so it’s a standard not a regulation. In the standards world we have formal de jure standards, and de facto (industry) standards. Same goes for compliance regulations. PCI is a defacto regulation really, compliance is enforced by the industry, and it isn’t optional.

I finally took a detailed look at 1.2, which is a whopping 72 pages. PCI 1.1 was 16 pages. PCI QSA’s are loving it. I wonder what that does to the average cost of a quarterly scan, or an annual audit?

A big part of increase is that they changed the format of the document to allow for audit test descriptions, but still, there’s a lot more in the new version. A couple of interesting things that the PCI SSC is doing as of 1.2:

-          They explicitly reference the OWASP top 10 vulnerabilities, and they require that if the OWASP list changes, the compliance requirement also changes (presumably in your next quarter’s PCI scan)

-          They have language for each requirement for audit test procedures, which is a REALLY good step IMHO (it eliminates some subjectivity from the QSA presumably). Version 1.1 just described the requirement, with 1.2 organizations can see the actual test procedure that the QSA will use, so they know exactly what to expect- no surprises.

Whether you love or hate PCI, I think it’s fair to say that it is the only major regulation that is changing anywhere near as fast as the threat environment is.