Chapter 15 - Myths and Misconceptions of PCI DSS

Abstract

This chapter looks at common Payment Card Industry Data Security Standard (PCI DSS) myths and misconceptions. One of the myths is that PCI DSS doesn't apply to small companies or Universities. It does not apply to those companies who outsource everything or don't store cards, or not a permanent entity. But the reality is that it does apply to an organization if it accepts payment cards or captures, stores, processes, or transmits any sensitive payment card data such as PAN with no exceptions. Another myth is that PCI is confusing and not specific. The reality is quite different: PCI DSS documents explain both what to do and then how to validate it. PCI is actually much easier to understand than other existing security and risk management frameworks and regulatory guidance. PCI DSS is considered to be too expensive, complicated, and burdensome. The reality is that PCI DSS exemplifies common sense, baseline security practices, which every organization needs to take into account when planning their IT and business operations. Another myth that is driven by the media is that the recent card data breaches prove PCI irrelevant, which is again not true.