# Nine key factors to maintaining payment security compliance
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2019-03-29
Category: BUSINESS
Category URL: https://financedigest.com/category/business
Meta Title: PCI DSS Compliance: Maintaining Payment Security Standards
Meta Description: Learn why maintaining full compliance with the Payment Card Industry Data Security Standard is crucial for businesses to protect payment systems from breaches
URL: https://financedigest.com/nine-key-factors-to-maintaining-payment-security-compliancehtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/tactics-1736839080838-compressed.jpg)

By **Gabriel Schild**, Executive Director Digital Business Transformation at Verizon

Consumers and suppliers both trust brands to effectively secure their payment data, however [research](http://www.verizonenterprise.com/verizon-insights-lab/payment-security/2018) shows that compliance with the Payment Card Industry Data Security Standard (PCI DSS), the standard that protects this data is slipping. In order to stop this downward trend, businesses need to reassess their measurement methodologies for [PCI](https://www.financedigest.com/worldpay-claims-first-with-p2pe-certification-for-omni-channel-solution.html) control effectiveness, and to concentrate on managing the sustainability of their data protection.

**Why is compliance so important?**

The [Payment Card](https://www.financedigest.com/can-banks-acquire-customers-with-biometric-payment-cards.html "Can banks acquire customers with biometric payment cards?") Industry Data Security Standard (PCI DSS) helps businesses that offer card payment facilities protect their payment systems from breaches and theft of cardholder data. PCI DSS compliance has been shown (via the [Verizon Data Breach Investigations Report](https://www.verizon.com/about/news/ransomware-still-top-cybersecurity-threat-warns-verizon-2018-data-breach-investigations-report) series) to help protect payment systems from both data breaches and theft of cardholder data, highlighting how vital compliance is.

However, after documenting improvements in Payment Card Industry Data Security Standard (PCI DSS) compliance over the past six years (2010 – 2016), [Verizon’s 2018 Payment Security Report](http://www.verizonenterprise.com/verizon-insights-lab/payment-security/2018) (PSR) now reveals a worrying downward trend with companies failing compliance assessments and perhaps, more importantly, not maintaining full compliance.

**The facts speak for themselves**

[Data gathered by our PCI DSS qualified security](https://www.financedigest.com/normalizing-advanced-cloud-data-security-with-normalyze-from-amer-deeba-and-ravi-ithal.html "Normalizing Advanced Cloud Data Security with Normalyze from Amer Deeba and Ravi Ithal") assessors (QSAs) during 2017 demonstrates that PCI compliance is decreasing amongst global businesses, with only 52.4 percent of organisations maintaining full compliance in 2017, compared to 55.4 percent in 2016. Regional differences are highlighted, demonstrating that companies in the Asia-Pacific region are more likely to [achieve full](https://www.financedigest.com/what-businesses-can-achieve-with-microsofts-full-suite-of-process-automation-tools.html "What businesses can achieve with Microsoft’s full suite of process automation tools") compliance at 77.8 percent, compared to those based in Europe (46.4 percent) and the Americas (39.7 percent).

Often these differences can be attributed to the timing of geographical compliance rollout strategies, cultural appreciation of awards/recognition, or the maturity of IT systems. For example, a PCI project is started in one region and then rolled out [across the globe](https://www.financedigest.com/germany-u-s-agree-to-new-covid-curbs-as-omicron-spreads-across-globe.html "Germany, U.S. agree to new COVID curbs as Omicron spreads across globe"). This means that [key learnings](https://www.financedigest.com/microlearning-puts-reskilling-in-the-fast-lane-key-learnings-from-financial-services.html "Microlearning puts reskilling in the fast lane: Key learnings from financial services") are often made and problem areas solved prior to the compliance assessments taking place in other regions.

**Every [business sector has its own compliance challenges](https://www.financedigest.com/global-lycopene-market-outlook-business-challenges-investment-opportunities-progression-status-revenue-expectation-and-forecast-2022-2029.html "Global Lycopene Market Outlook Business Challenges, Investment Opportunities, Progression Status, Revenue Expectation and Forecast 2022-2029")**

No two business sectors are the same and this also runs true when it comes to [payment security](https://www.financedigest.com/contactless-payments-the-way-of-the-future-or-security-scare.html "Contactless Payments – The Way of the Future or Security Scare?") compliance.

Generally, our research saw IT services [remain on top](https://www.financedigest.com/high-barrier-packaging-films-for-pharmaceuticals-market-set-for-5-cagr-through-2029-blisters-remain-top-application-area-says-a-new-fmi-report.html "High Barrier Packaging Films for Pharmaceuticals Market Set for 5% CAGR Through 2029; Blisters Remain Top Application Area, Says a New FMI Report") when it came to compliance, with over three-quarters of organizations (77.8 percent) achieving full status. Retail (56.3 percent) and financial [services](https://www.financedigest.com/how-advanced-self-service-technologies-are-changing-the-face-of-finance.html "How Advanced Self-Service Technologies are Changing the Face of Finance") (47.9 percent) were significantly ahead of hospitality organizations (38.5 percent), which demonstrated the lowest compliance sustainability. As we now see businesses often leveraging PCI DSS compliance efforts to meet the security requirements of [data protection](https://www.financedigest.com/modern-data-protection-how-organisations-can-protect-against-cyber-attacks.html "Modern Data Protection: How organisations can protect against cyber attacks") regulations, such as the European Data Protection Regulation (GDPR), this gap between the various business sectors that deal with electronic payments on a daily basis is significant.

It is important to remember that one [size does not fit all when it comes to compliance strategies as different Industries](https://www.financedigest.com/industrial-degreaser-market-2022-by-global-key-players-types-applications-countries-industry-size-and-forecast-to-2030.html "Industrial Degreaser Market 2022 by Global Key Players, Types, Applications, Countries, Industry Size and Forecast to 2030") have different risks inherent to their specific activities. For example, whilst [businesses](https://www.financedigest.com/pstn-isdn-switch-off-what-businesses-need-to-know.html "PSTN/ISDN switch-off: what businesses need to know ") need to be compliant to the entire standard to be PCI DSS certified – retail stores need to specifically concentrate on the security of their ‘Payment Terminals’ (PCI DSS Chapter 9 and Chapter 2); eCommerce is totally different and should focus on all Internal and external scans related to the ‘Web server’ (PCI DSS Chapter 11), not to forget Hardening (PCI DSS Chapter 2) and ‘Key Management for Databases’ (PCI DSS Chapter 3) and finally Financial Services need to be good in all aspects of the Standard. Our experts often see this business sector struggle most with Chapter 6 ‘Develop and [Maintain secure](https://www.financedigest.com/maintaining-security-and-compliance-amid-digital-transformation-in-financial-services.html "Maintaining Security and Compliance amid Digital Transformation in Financial Services") systems’ and Chapter 2 ‘Do not use vendor supplied defaults’.

**Control effectiveness and sustainability are essential**

Over the years we have seen that maintaining compliance is often the issue – specialist PCI Compliance project leaders can leave mid project and the awareness of a company’s compliance status leaves with them; in addition, we [see many companies](https://www.financedigest.com/wait-and-see-u-s-companies-curb-investment-as-they-await-fed-moves.html "Wait and see: U.S. companies curb investment as they await Fed moves") floundering without a clear structure to sustain [compliance.](https://www.financedigest.com/the-role-of-compliance-consulting.html) Or alternatively we see unskilled professionals being tasked with maintaining compliance with the PCI standard but they do not have the basic knowledge to achieve this goal.

As such we have devised nine [factors of control effectiveness and sustainability to support the 12 key](https://www.financedigest.com/automotive-soft-trim-interior-materials-market-size-key-players-growth-factors-regions-and-applications-industry-forecast-by-2026.html "Automotive Soft Trim Interior Materials Market Size, Key Players, Growth Factors, Regions and Applications, Industry Forecast by 2026") requirements of the PCI DSS standard, these are as follows:

- **Factor 1: Control Environment:** The sustainability and effectiveness of the 12 Key Requirements depends on a healthy **Control Environment**.
- **Factor 2: Control Design:** Proper control [operation to meet DSS security](https://www.financedigest.com/transport-operator-go-ahead-flags-cyber-security-breach.html "Transport operator Go-Ahead flags cyber security breach") control objectives depends on sound **Control Design.**
- **Factor 3: Control Risk:** Without on-going maintenance ( [security testing](https://www.financedigest.com/london-police-say-queens-funeral-poses-biggest-ever-security-test.html "London police say queen’s funeral poses biggest ever security test"), risk management, etc.), controls can degrade over time and eventually break down.  Mitigation of control failures requires [integrated management](https://www.financedigest.com/power-management-integrated-circuit-pmic-market-research-report-2022-global-forecast-till-2028.html "Power Management Integrated Circuit (PMIC) Market Research Report 2022 – Global Forecast till 2028") of **Control Risk.**
- **Factor 4: Control Robustness:** Controls operate in dynamic [business and ever-changing threat](https://www.financedigest.com/the-best-ways-to-protect-your-business-from-cyber-threats-in-2021.html "The best ways to protect your business from cyber threats in 2021") environments.  They must be **robust** to resist unwanted change to remain functional and perform to specifications (configure standards, access control, system hardening, etc.).
- **Factor 5: Control Resilience:** Security controls can potentially still fail, despite adding layers of control for increased robustness, therefore control **resilience** with proactive discovery and quick recovery from failure is essential for effectiveness and sustainability .
- **Factor 6: Control Lifecycle Management:** To achieve all of the above it is necessary to monitor and actively [manage security](https://www.financedigest.com/finding-it-hard-to-recruit-good-it-security-managers-dont-leave-yourself-vulnerable-to-attack.html "Finding it hard to recruit good IT security managers? Don’t leave yourself vulnerable to attack") controls throughout each stage of their **lifecycle** from inception to retirement.
- **Factor 7: Performance Management:** Establishing and communicating **performance standards** to measure the actual performance of the control environment improves control effectiveness, and promotes predictable outcomes of your [data protection and compliance activities](https://www.financedigest.com/oil-slips-on-china-covid-curbs-weak-factory-activity-data.html "Oil slips on China COVID curbs, weak factory activity data"), allowing for early identification and correction of performance deviations.
- **Factor 8: Maturity Measurement:** A control environment should never be stagnant – it must improve continuously. To do so, businesses need a roadmap, a target level of process and capability **maturity** to track the degree of formality and optimization of [processes](https://www.financedigest.com/crowdsourcing-of-data-to-drive-the-high-throughput-process-development-market.html "Crowdsourcing of data to drive the High Throughput Process Development Market") as indication of how close developing processes are to being complete and capable of continual improvement.
- **Factor 9: Self-Assessment:** Achieving all of the above requires in-house proficiency – resource capacity (people, processes and technology), capability (supporting processes), competency (skills, knowledge and experience) and commitment (the will to consistently adhere to compliance requirements) – in short: **self-assessment** proficiency

Passing PCI compliance validation doesn’t mean that systems are ‘secure’, just that there was no evidence of non-compliance during the [assessment period](https://www.financedigest.com/home-care-chemicals-market-is-expected-to-expand-at-a-cagr-close-to-5-over-the-assessment-period-of-2021-and-2031.html "Home Care Chemicals Market is expected to expand at a CAGR close to 5% over the assessment period of 2021 and 2031"), which is typically just a week or two. On the flip side, security [systems are often tested](https://www.financedigest.com/interoperability-of-data-to-accelerate-the-ventilator-test-systems-market.html "Interoperability of data to accelerate the Ventilator Test Systems Market") every day. Sustaining compliance with the PCI DSS Standard is not a project, a one-off activity, but an ongoing programme. A programme that needs to [adapt to the changing](https://www.financedigest.com/change-is-inevitable-how-banks-need-to-adapt-to-customers-new-banking-habits.html "Change is inevitable – how banks need to adapt to customers’ new banking habits") needs of business and new technologies that may be introduced into the business environment.

The key to a [compliance processes being effective](https://www.financedigest.com/ifrs-15-moving-away-from-short-term-fixes-is-vital-for-effective-compliance.html "IFRS 15: Moving away from short-term fixes is vital for effective compliance") is the need to be driven from the top. Often this is hindered by the simple fact that general progress or challenges are not clearly communicated or understood by executives. By structuring the compliance process and conversations on our nine factors of control effectiveness and sustainability, executives can obtain a clearer understanding of the process involved and a clearer dialogue can be opened up to avoid unnecessary obstacles.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---