Retailers that have suffered payment card data breaches in recent years have often noted that the compromise occurred even though they were certified as compliant with the requirements of the Payment Card Industry (PCI) data security standard.

The Payment Card Industry Data Security Council, which administers the standard, has flatly rejected such claims, arguing that companies that fully comply cannot be breached. Therefore, it states, if a company is indeed breached, it could not have been PCI compliant.

Empirical Support

Circular as that argument might sound, it appears to have some empirical support. Verizon Enterprise Solutions is in the process of finishing a report on the relationship between compliance with the standard and data breaches at retailers, restaurants and other organizations that rely heavily on payment card transactions.

Though the full 2015 PCI report is due in February, preliminary results show that not a single breached company in the study fully complied with the standard at the time of the incident. Verizon’s report is based on a review of three years’ worth of data gathered from compliance assessments conducted by the company’s team of assessors for large firms in more than 30 countries.

“The initial glance at the data suggests that many companies fall out of compliance once it’s achieved,” Verizon noted in a statement announcing the preliminary findings. “In fact, fewer than one-third were still fully PCI-compliant less than a year after being validated” for compliance. The results show that companies that were breached were noncompliant, Verizon said.

PCI Compliance Challenges

The report identified two areas in which companies appear to have a particularly difficult time remaining compliant: firewalls and testing security systems and processes.

The results show that organizations need to change the way they approach security, according to Rodolphe Simonetti, director of compliance and governance at Verizon Enterprise Solutions.

“Businesses need to adopt a model that we call ‘resilience,’ which means they must accept they can never be fully secure,” he said. “There is no silver bullet for data protection.”

For the Security Council, the results validate its position that breaches only happen to companies that do not fully comply with the standard. However, they also reflect some of its shortcomings and the challenges involved in staying compliant, Avivah Litan, an analyst at Gartner, said in an interview.

Moving Target

Since at least 2006, many companies that have suffered data breaches have insisted they were certified as being compliant with requirements just before the breach, or even when it was happening, Litan said. That reflects both the subjectivity involved in the compliance assessment process and the fact that controls required by the standard alone are insufficient to protect against a breach.

“PCI is not black and white; it’s gray. A lot of [compliance] decisions are subject to the assessor’s opinion,” she said.

In other words, a company certified as being compliant by one assessor may not earn that same certification from another. The results also show just how much of a moving target compliance can be, according to Litan. Certified companies can often quickly fall out of compliance merely by adding new servers or software to their network.

The payment card standard specifies a set of high-level security controls that protect payment card data from being compromised. This standard applies to all companies that accept credit and debit card payments. However, compliance requirements vary. For instance, credit card associations such as Visa and MasterCard classify companies that handle over 6 million payment card transactions as Level 1 merchants, which have higher compliance requirements than companies lower down the stack.

PCI-covered entities that suffer data breaches can face stiff fines and other penalties if they were not compliant at the time of the breach.

More from

Increasingly Sophisticated Cyberattacks Target Healthcare

4 min read - It’s rare to see 100% agreement on a survey. But Porter Research found consensus from business leaders across the provider, payer and pharmaceutical/life sciences industries. Every single person agreed that “growing hacker sophistication” is the primary driver behind the increase in ransomware attacks. In response to the findings, the American Hospital Association told Porter Research, “Not only are cyber criminals more organized than they were in the past, but they are often more skilled and sophisticated.” Although not unanimous, the…

4 min read

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

Machine Learning Applications in the Cybersecurity Space

3 min read - Machine learning is one of the hottest areas in data science. This subset of artificial intelligence allows a system to learn from data and make accurate predictions, identify anomalies or make recommendations using different techniques. Machine learning techniques extract information from vast amounts of data and transform it into valuable business knowledge. While most industries use these techniques, they are especially prominent in the finance, marketing, healthcare, retail and cybersecurity sectors. Machine learning can also address new cyber threats. There…

3 min read

HHS Releases Hospital Cyber Resiliency Landscape Analysis

4 min read - On April 17, 2023, The U.S. Department of Health and Human Services (HHS) 405(d) Program announced the release of its Hospital Cyber Resiliency Initiative Landscape Analysis. This landmark analysis reports on domestic hospitals’ current state of cybersecurity preparedness. The scope of the HHS study was limited to activities that protect access to patient care and safety and reduce the negative impact of cyber threats on clinical operations. Breaches of sensitive data were considered only if the breach had a direct…

4 min read