Weak Enforcement and Low Compliance in PCI~DSS: A Comparative Security Study
By: Soonwon Park, John D. Hastings
Potential Business Impact:
Makes credit card rules work better.
Although credit and debit card data continue to be a prime target for attackers, organizational adherence to the Payment Card Industry Data Security Standard (PCI DSS) remains surprisingly low. Despite prior work showing that PCI DSS can reduce card fraud, only 32.4% of organizations were fully compliant in 2022, suggesting possible deficiencies in enforcement mechanisms. This study compares PCI DSS with three data security frameworks, HIPAA, NIS2, and GDPR, to examine how enforcement mechanisms relate to implementation success. The analysis reveals that PCI DSS significantly lags far behind these security frameworks and that its sanctions are orders of magnitude smaller than those under GDPR and NIS2. The findings indicate a positive association between stronger, multi-modal enforcement (including public disclosure, license actions, and imprisonment) and higher implementation rates, and highlights the structural weakness of PCI DSS's bank-dependent monitoring model. Enhanced non-monetary sanctions and the creation of an independent supervisory authority are recommended to increase transparency, reduce conflicts of interest, and improve PCI DSS compliance without discouraging card acceptance.
Similar Papers
A NIS2 pan-European registry for identifying and classifying essential and important entities
Cryptography and Security
Helps EU countries track and protect important computer systems.
SoK: Security of EMV Contactless Payment Systems
Cryptography and Security
Finds ways to make contactless payments safer.
Differential Privacy for Regulatory Compliance in Cyberattack Detection on Critical Infrastructure Systems
Cryptography and Security
Protects power grids from hackers, keeping secrets safe.