Significantly, at a time when IT budgets are under close scrutiny because of the difficult economic conditions, the survey found that 77% of respondents have not had problems securing funding and resource to ensure PCI DSS requirements are met, suggesting that the importance of PCI compliance is now widely understood at Board-level within businesses. Indeed, 64% agree that PCI improves the overall security of cardholder information; 50% say that PCI compliance will improve attention to information and security, and help protect data privacy; and 44% say that PCI compliance will help enhance brand reputation by giving consumers greater confidence.
However, despite the majority of respondents saying they were confident about achieving PCI compliance, the research survey found that 32% are currently responding to weaknesses that were identified in their PCI DSS pre-audit; 27% of companies will put off becoming PCI compliant for as long as possible; 14% have completed a PCI DSS pre-audit but not undertaken any further action; and 14% are not compliant and are not in the process of becoming so. In addition, 39% of respondents believe that credit card security should be the problem of the credit card companies.
Another key finding was that only 26% of respondents have a dedicated PCI DSS Project Manager. Indeed, 78% say that PCI compliance falls within the remit of IT Security within their organisation which adds to an already busy workload for IT security professionals.
Furthermore, only 24% of respondents were completely satisfied with their organisation’s ability to alert personnel to unauthorised modification of critical files and maintain file integrity on systems within the scope of PCI; only 44% of respondents were completely satisfied with their organisation’s ability to ensure critical systems are properly configured and have the right software patches installed; and only 30% were completely satisfied with their ability to log and track user activities critical to preventing, detecting or minimising the impact of data compromise.
The research study also highlights that smaller businesses are lagging behind larger organisations in terms of PCI readiness. 56% of Level 4 merchants and 36% of Level 3 merchants do not fully understand PCI requirements; in contrast, only 14% of Level 2 merchants do not fully understand the requirements, whilst all Level 1 merchants said that they fully understand the requirements. When asked whether they were confident about meeting the September 2010 deadline, 21% of Level 3 merchants said they would not be compliant in time, and a further 25% of Level 3 merchants did not know if they would be compliant in time; 7% of Level 4 merchants said they would not be compliant, and a further 31% said they did not know if they would be compliant. Only 11% of Level 2 merchants were unsure about achieving compliance, whilst all Level 1 merchants were confident about meeting the deadline.
Comparing the results by industry sector, 57% of retailers admitted that they still do not fully understand PCI requirements, compared to 27% of finance companies and 27% of leisure companies. 20% of finance companies said they would not be compliant by the September 2010 deadline, and a further 20% of finance respondents did not know if they would meet the deadline. Furthermore, 25% of retailers did not if they would be compliant, whilst only 9% of leisure companies were unsure about hitting the deadline.