Payment Card Industry Security Standards Council

Payment Card Industry Security Standards Council. The Payment Card Industry Security Standards Council is a global forum established to develop, enhance, disseminate, and assist with the implementation of security standards for account data protection. It was founded in 2006 by the major payment card brands, including American Express, Discover, JCB, Mastercard, and Visa, to unify and manage the previously separate data security programs of these companies. The council's primary mission is to increase controls around cardholder data to reduce credit card fraud and secure the global payment system through a set of technical and operational standards.

History and formation

The council was officially formed on September 7, 2006, in response to the growing threat of data breaches and the need for a consistent approach to payment card security. Prior to its creation, each major payment card network maintained its own compliance program, such as Visa's Cardholder Information Security Program and Mastercard's Site Data Protection program, leading to complexity for merchants and financial institutions. The founding members—American Express, Discover, JCB, Mastercard, and Visa—sought to consolidate these efforts under a single entity. The establishment followed several high-profile security incidents, including the 2005 CardSystems Solutions breach, which underscored vulnerabilities in the payment processing ecosystem. The council's initial headquarters were established in Wakefield, Massachusetts, with Bob Russo serving as its first General Manager.

PCI Security Standards

The council manages a portfolio of security standards, the cornerstone of which is the PCI Data Security Standard (PCI DSS). This comprehensive framework mandates requirements for security management, policies, procedures, network architecture, software design, and other protective measures. Other key standards include the PCI Pin Transaction Security (PCI PTS) for point-of-sale device security, the Payment Application Data Security Standard (PA-DSS) for software vendors, which was superseded by the PCI Software Security Framework, and the PCI Point-to-Point Encryption (PCI P2PE) standard for encrypting cardholder data from the point of interaction. These standards are developed and updated through a collaborative process involving the PCI Security Standards Council's participating organizations, which include banks, processors, merchants, and technology vendors from across the payment card industry.

Governance and structure

Governance is overseen by a board of advisors comprised of representatives from the five founding payment card brands: American Express, Discover, JCB, Mastercard, and Visa. The council's executive committee, led by an Executive Director such as Lance J. Johnson, manages daily operations. A larger body of participating organizations, including hundreds of global financial institutions, merchants, point-of-sale vendors, and security assessors, contributes to the standards development process through special interest groups and community meetings. Key committees, like the PCI Security Standards Council's Board of Advisors and various technical working groups, review and approve all updates to the standards library. The organizational structure is designed to foster industry-wide collaboration while maintaining the strategic direction set by the founding members.

Compliance and validation

Compliance with standards like the PCI Data Security Standard is mandated by the individual payment card brands and enforced through contracts with merchants, service providers, and financial institutions. Validation requirements vary based on an entity's transaction volume and are typically performed annually. Organizations may validate compliance through a formal assessment conducted by a Qualified Security Assessor (QSA) or by completing a Self-Assessment Questionnaire (SAQ). For software vendors, validation was historically done under the Payment Application Data Security Standard (PA-DSS). Additionally, Approved Scanning Vendors (ASVs) perform external vulnerability scans. The council itself does not enforce compliance or levy fines; enforcement is managed directly by the payment card networks, such as Visa or Mastercard, which can impose significant penalties for non-compliance.

Impact and criticism

The standards have significantly shaped global information security practices, raising the baseline for data protection within the financial services sector and beyond. They are credited with reducing the incidence of credit card fraud and creating a common security language for banks, merchants, and technology providers. However, the framework has faced criticism from some merchants and security experts for being costly and complex to implement, particularly for small businesses. Critics argue that compliance does not equate to comprehensive security and can create a false sense of safety. Some incidents, like the 2013 Target data breach, occurred despite the retailer being PCI DSS compliant at the time, leading to debates about the standard's effectiveness against advanced persistent threats. The council continuously revises its standards in response to such evolving cyber threats and industry feedback.

Category:Computer security organizations Category:Payment systems Category:Organizations based in Massachusetts Category:Organizations established in 2006