FTC Scrutinizes Payment Card Data Security

No matter the size of your business, if you accept, transmit or store credit cardholder data, you must comply with the Payment Card Industry (PCI) Data Security Standards (DSS) because card-issuers and banks require it.  While full compliance with the PCI DSS is generally thought to reduce the costs to your business and your customers in the event of a data breach, it appears that compliance is now in the crosshairs of the Federal Trade Commission (FTC).

On March 7, 2016, the FTC issued a press release publicizing its orders to nine companies, including PWC and Mandiant, requiring that they provide information regarding their PCI DSS auditing practices.  Businesses typically hire the subject companies to conduct auditing services, which are supposed to determine the businesses' compliance with the 12 requirements in the PCI DSS.  However, the FTC is specifically requesting information about businesses that have suffered data breaches despite being deemed PCI compliant.