Society of Payment Security Professionals - Payment Security Blog

PCI will not bake you bread

One of the eternal issues people raise about PCI is that it is not perfect. People point out flaws, which are then corrected or explained through interpretation. But this is normal and fully expected. It’s when people expect PCI to somehow be the ubermensch of compliance programs — that somehow it is flawed if it does not do everything, even bake me bread — that is when I sigh.

Here are some things that PCI does not (and is not meant to) do:

1. Prevent all data compromises. The goal of PCI is to prevent the electronic and paper theft of credit card data. It does not prevent credit card skimming, an employee writing down credit card numbers and taking them, or other unscrupulous methods of fraud.
2. Police the Internet. Some people feel that PCI should provide not only the rules and enforcement for data security, but also act as a universal arbitrator for all things data security related.
3. Enforce Biblical Rule. PCI is not meant to enforce the, “thou shalt not lie” concept. The ha.ckers.com group wrote about how to “subvert” PCI, but it’s not special to PCI. Can you fool your FDIC examiner into thinking you are GLBA compliant by lying to them? Can you fool your CPA auditor into thinking you are SOX compliant by feeding them false data? Sure - what’s new?

Update: See also comments here from the Belgians. Algemeen reminds us about what I mentioned in rule #1. But if you are spending the money to secure your credit card data why not extend that security infrastructure, at minimal additional cost, to protect all personally identifiable information (PII).