As data breaches continue to rise globally, protecting the integrity of customer data (especially in the payments world) is vital.
One essential security standard helping keep such data secure is PCI DSS — an information security standard for organizations that handle cardholder data. But aligning with the standard can be complex, time-consuming and costly. As result, many payments stakeholders are becoming complacent about compliance.
In fact, less than 18% of organizations measure their DSS controls across their entire environment more frequently than requirements specify. While doing the bare minimum means that companies avoid receiving hefty non-compliance fines, it doesn’t achieve a great deal more.
Adopting a compliance framework that complements commercial objectives alongside the latest security and privacy requirements is key to truly reap the benefits of PCI DSS. With a new approach, stakeholders can maximize their investment in compliance to achieve greater efficiencies, tap into new revenues and deliver more valuable services to customers. With this in mind, how can the business opportunities of PCI DSS be unlocked?
Defining the scope — where organizations outline the infrastructure that falls under the requirements of the standard — is one of the most important phases of PCI DSS compliance. But by using it as an opportunity to scrutinize systems, it can also be a useful tool to streamline operations and "reduce the scope" of compliance.
Consider insuring a house. Without any locks on the doors or windows, premiums will be high. But, by considering all entry points and securing them effectively, the risk can be reduced. Taking this one step further, by permanently blocking an unused entrance, for example, the risk posed to the house can be dramatically reduced — and, in turn, so can the insurance premiums.
Scope reduction with PCI DSS works on the same principles. With the right attitude, companies can significantly reduce the scope of their systems that fall under PCI DSS, reducing the risk, ongoing expense and time of compliance.
Once your payment infrastructure is in place, it can be difficult to both critically assess your own systems and challenge the different parts of the chain, such as processors and acquirers. It’s very easy to say, “It works, so why touch it?” but this can be a costly approach longer term.
PCI DSS compliance is the perfect trigger to ask: Why do we do it this way? Can we be more secure? Can we be more efficient? How can we do better? By using the time dedicated to review systems and achieve compliance more constructively, players can spot opportunities to put in place better processes, methodologies and technologies. The resulting systems are not only smoother operationally, but deliver significant cost and time efficiencies long term.
If implemented intelligently, new technologies added to achieve compliance can also supplement the delivery of new value-added services.
Take payment tokenization, for example, which is used to encrypt end-to-end cardholder data. While significantly reducing the scope of compliance, these tokens can also be used to identify customers across omnichannel retail environments and automate loyalty programs without (or alongside) a separate loyalty card. For brick-and-mortar retailers, tokens can help bridge the gap between the online and offline world while bringing greater simplicity and flexibility to the consumer.
Loyalty programs are hugely effective in increasing revenues (members on average spend $42.33 more than other shoppers), so tapping into this market helps maximize return on investment.
PCI DSS is currently applied only to transactions routed by the PCI member payment schemes. But, they’re a strong benchmark for the protection of all payment systems and customer data universally.
If already applying PCI DSS for card payments, extending it to cover "transactions" generally — protecting instant payments, credit transfers, P2P payments, international banking account numbers (IBANs) and more — can help safeguard and secure systems for the future.
Following the PCI DSS rules blindly can be costly, complex and, in some cases, impossible. The guidelines need to be applied intelligently, using new methodologies and technologies to do things in new, better ways and, in turn, realize commercial benefits beyond compliance.
All of this can be hard to achieve alone, but with the right approach, businesses can make PCI DSS work for them.
