Problem solve Get help with specific problems with your technologies, process and projects.

Why are there still various independent credit card security standards?

PCI DSS has become the well-known information security standard for credit cards, but vendors can still have different approaches to card data security.

If there is supposed to be a consolidated security standard among American Express, Visa and Mastercard, why are there still independent security programs that you have to follow for each vendor? For example, AmEx has its DSOP that has to be followed.
The Payment Card Industry Data Security Standard (PCI DSS) is that consolidated standard that you refer to. Yet, it is perceived to be a minimum level of security required to protect private customer data. Each of the major credit card issuers reserves the right to build additional security requirements on top of PCI DSS.

This is not a bad thing because as we all know, PCI DSS is not the end-all and be-all for security. It's true that it's the most specific and therefore most useful of the standards for compliance, but it's by no means foolproof. I've long held that organizations should stay focused on security and not compliance. If a company is doing a good job on security, then in all likelihood it will be compliant with most regulations.

American Express' Data Security Operating Policy (DSOP) (pdf) isn't really another set of requirements to follow. Rather, the DSOP clarifies AmEx's expectation of documentation and scanning for merchants of a certain size. Amazingly enough, the transaction volumes roughly equate to the way retailers are tiered into specific levels for PCI DSS.

The DSOP also specifies the ramifications of not promptly notifying AmEx of a potential breach. There is a lot of legalese in this section, but the gist is that AMEX will rake a company through the coals if it doesn't quickly and fully disclose a potential data breach. This is consistent with the overarching PCI DSS focus on pushing the liability of data breaches down to the retailers.

More information:

This was last published in January 2008

Dig Deeper on PCI Data Security Standard

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.