No matter the size of your business, if you accept, transmit or store credit cardholder data, you must comply with the Payment Card Industry (PCI) Data Security Standards (DSS) because card-issuers and banks require it. While full compliance with the PCI DSS is generally thought to reduce the costs to your business and your customers in the event of a data breach, it appears that compliance is now in the crosshairs of the Federal Trade Commission (FTC).
On March 7, 2016, the FTC issued a press release publicizing its orders to nine companies, including PWC and Mandiant, requiring that they provide information regarding their PCI DSS auditing practices. Businesses typically hire the subject companies to conduct auditing services, which are supposed to determine the businesses' compliance with the 12 requirements in the PCI DSS. However, the FTC is specifically requesting information about businesses that have suffered data breaches despite being deemed PCI compliant.
If you are a business owner who relies on credit cards, you will want to double-down on ensuring compliance with the PCI DSS, and watch how the companies respond and what steps the FTC takes next.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
