“Notice: You are responsible for any and all costs caused by a data security violation of your transaction processing systems. Merchants are required to obtain certification from a qualified data security professional stating that the merchant’s transaction processing systems provide adequate data security. Recommended data security guidelines and a list of data security professionals who have been trained in them can be found on the PCI SSC web site.”

The end result of the above approach would be identical to what we have today, but it would eliminate all the hysteria about “achieving” and “maintaining” the mythical and elusive “PCI compliance,” which is completely unnecessary since merchants who are breached will be held responsible for costs and fined anyway (just ask Heartland).

The PCI council was assembled by and represents the Payment Card Industry, who is made up of the credit card companies, and who was put together to represent the credit card companies in matters of security. It certainly seems like a reasonable point of contact to me.

Would you rather the individual members of the NRF speak to each and every bank, and hope a solid standard emerges from the chaos? I should think that collective discussion in a single forum would be more productive.

Require credit card companies and their banks to provide merchants with the option of keeping
nothing more than the authorization code provided at the time of sale and a truncated receipt,
rather than requiring merchants to store credit card information for dispute resolution, putting
customers at unnecessary risk.

The PCI Council does not dictate to the credit card companies what there rules should be. This should have been in a letter to the credit card companies not the PCI Council.

You may want to reread the points and then dig a little further to understand the whole process before throwing this out. I think you will find that there is so much more to this whole mess than just the current version of PCI-DSS.

Their point about credit card retention is simple (by the way, if you read the article they never said that PCI requires the retention): credit card companies and banks require the merchants to keep the card number in a retrievable format *if* the company ever wants to win a payment dispute. This isn’t a PCI-point, it’s part of the agreement between the cc companies/banks and the merchant. Rather than insisting that the PAN and expiry date and name be stored, give the retailers the option of using other identifiers. In other words, they are suggesting that PCI build in a requirement that the banks/issuers have to live by as well. If they did this very few retailers would actually opt to keep the cc data at all. Most don’t do it for fun, they do it to protect themselves from chargebacks/disputes etc because they have no other option. I believe someone recently told congress that PCI-DSS was not much more than an elegant patch for a broken system. This is why.

I also don’t find anything in the current PCI DSS v1.2 that says you can’t use end-to-end encryption. The PCI standard is a minimum baseline for information security. If retailers want to do more and implement end-to-end encryption I don’t see anything stopping them. Do they really want PCI to require every merchant and service provider to implement end-to-end encryption? Think of the cost and time to implement that!

Lastly, why does the NRF continue to say that PCI requires retailers to store cardholder data? The standard is very clear about not storing data that is not needed, having a defined retention period, and rendering data that you do store unreadable. I personally can’t find anything in the PCI DSS v1.2 that says they must store cardholder data.

I think this group should be more informed and read the PCI standard before they attack it.

Imagine being a supplier who receives a vendor compliance guide from 20 different retailers – with about 5% of the compliance penalties being the same across all the retailers (which is accurate based on an RCC study from a couple years ago). Maybe retailers will consider more strategic supply chain-oriented metrics for, rather than tactical departmentally-based means of, driving supply chain success.