PCI experts say deadline is just the beginning

The deadline for retailers and other companies that handle credit card data to achieve compliance with the Payment Card Industry Data Security Standard has passed, but experts say that only a few large firms are already prepared to go under the microscope via external audits.

At midnight on Monday, the PCI DSS version 1.1 guideline officially went into effect, requiring that all credit and debit card handlers adhere to a stricter set of data protection rules implemented by the PCI Security Standards Council -- which is backed by prominent card issuers including AMEX, MasterCard, and Visa.

However, industry watchers familiar with the PCI standard contend that the work necessary to pass an audit based on the regulations remains incomplete inside all but the largest, most security-focused companies.

Despite having over a year to examine the PCI DSS requirements -- which include stipulations for businesses to encrypt any sensitive customer account information they store -- those people most familiar with the individual elements of the standard and the methods being employed by businesses to meet them claim that most organizations still have a long road ahead.

From perceived ambiguity regarding some of the PCI DSS requirements in some organizations to a seemingly inexcusable lack of concern within others, experts said that they would be surprised to find many businesses that are ready to undergo their audits today.

"A lot of companies want to be ready but can't because many of the core systems involved can't be changed to meet PCI needs that quickly," said John Pironti, chief information risk strategist at Getronics and a member of the Information Systems Audit and Control Association (ISACA) -- an industry group that represents the auditors who will carry out PCI compliance tests.

"It's a great incentive for the card companies to say, 'Go do it,' but the work is challenging and without as a big a deadline as something concrete like Y2K, people are going to handle it in different ways, especially around how they make any necessary investments," he said.

Pironti said that large numbers of companies affected by PCI, especially SMBs, are still struggling to replace aging backend and point-of-sale systems to help meet the more stringent security measures.

In other cases, companies are waiting for the PCI Security Standards Council to clear up questions about various elements of the mandate -- such as for vetting DSS compliance with business partners -- before making some of their related policy and technology decisions.

Other firms, emboldened by the fact the peers like TJX Companies have been able to experience major data exposure events without any apparent impact on their core business, have begun pushing back on their IT departments and asking why they need to sink so much time and money into the process of meeting the regulation at all, the expert said.

While TJX has reported that it will pay well over $100 million in remediation expenses related to its incident, in-store sales at the retail chain have actually increased since it announced its breach in Jan. 2007.