In a report released on September 28, 2011, Verizon concluded that only 21 percent of organizations subject to the payment card industry’s data security standards (PCI-DSS) were fully compliant with PCI-DSS.  Verizon’s prior report found that 22 percent of organizations were fully compliant with PCI-DSS.  The PCI-DSS consist of 12 requirements relating to an organization’s information security for cardmember data.  The report is based on PCI assessments conducted by Verizon’s team of qualified security assessors and investigations of security breaches.  Verizon found that organizations most often struggled with Requirements 3 (protection of stored data), 11 (testing security systems and processes), and 12 (maintain a policy that addresses information security).   The report contains a number of interesting observations about the industry’s approach to complying with the 12 PCI-DSS requirements.

PCI compliance is essential for merchants and payment processors that accept, store, or transmit cardmember data.  PCI compliance routinely is assessed in the context of strategic transactions and becomes a focal point in the event of a data breach.