Report: PCI Compliance: Finding Value beyond Fine Avoidance TOC

Overview
Primary Questions
Findings and Analysis
What Is the Real Value of PCI Compliance?
Consumers Will Reward Security Leaders, But How to Tell?
- Consumers Prefer a PCI-Brand to Help them Feel Safer When Shopping
“Safe Harbor” Needed to Ensure Conformity and Effectiveness for Merchants
- What Do State PCI and Data Breach Laws Imply for Merchants?
Is Effective QSA Management a Missing Link in the PCI Compliance Process?
Even with Progress in Outreach and Education, Merchant Confusion Lingers
Despite Strong Improvement, All Payment Networks Must Be Actively Involved
The Cost of PCI Compliance: Is it Worth the Expense?
What Are the Five Top Weaknesses for Merchants Facing Compliance?
- Highly Distributed , Sensitive Data,
- Data Controlled by Third Parties or Taken Off-Site
- Problems at the POS
- Legacy Systems and Niche Applications Bring Heightened Risk
- Lack of Logging and Oversight
Innovative Approach: Eliminate Storage and Passage of Card Information
- Standing PCI Compliance on its Head
  - EPX BuyerWall
  - Shift4' s SafeSwipe
Where Is PCI Compliance Heading in 2008?
- Merchant Questions Linger over PCI DDS 6.6
- Payment Application-Data Security Standard (PA-DSS)
Appendix
Related Research
Glossary

Figure 1: Top Ten Largest Publicly Reported Security Breaches
Figure 2: Consumers Are More Inclined to Shop at merchants that Are Security Leaders
Figure 3: Consumers Feel Most Protected by a Brand When Shopping
Figure 4: Current PCI State PCI Bills and Outcomes for Merchants
Figure 5: Payment Networks Are Managing their Acquirers, Acquirers Are Managing their Merchants: Who Is Managing the QSAs?
Figure 6: Inconsistencies among PCI Programs and the Lack of a Universal PCI Support Center Are Preventing Higher Compliance Rates
Figure 7: Slow but Steady Progress in Compliance Rates for Visa Merchants
Figure 8: Compliance Costs for Level 1 or 2 Merchant
Figure 9: Costs of Non-Compliance for Level 1 or 2 Merchant
Figure 10: Compliance Costs/Steps for a Level 4 Merchant
Figure 11: Which Cardholder Data Elements Can Be Stored under PCI Compliance Rules?
Figure 12: Payment Application-Data Security Standards (PA-DSS) Timeline
Figure 13: Consumer Viewpoint: Who Is Least Secure in Protecting Account Information?
Figure 14: Definitions of Merchant Levels One to Four
Figure 15: Visa PCI Compliant Merchants as of August 31, 2007

PCI Compliance: Finding Value beyond Fine Avoidance