Executive Summary: Effective January 1, 2014, companies
involved in payment card processing must meet new data security
requirements.
The PCI Security Standards Council ("PCI SSC" or the
"Council") recently released Version 3.0 of the
Payment Card Industry Data Security Standards ("PCI
DSS" or the "Standards"). A
table summarizing the changes to the previous version is
available on the Council's website. The
Standards go into effect on January 1, 2014, but companies have
until December 31, 2014 to make the transition from Version 2.0 to
Version 3.0.
What Are the Standards and Who Must Comply? The Standards apply
to all entities involved in payment card processing, such as
merchants, processors, financial institutions, and service
providers, and to any entity that stores, processes or transmits
cardholder data and/or sensitive authentication data. Cardholder
data and sensitive authentication data includes, for example, the
primary account number, cardholder
