Understanding the Consequences of Failing PCI Compliance
Failing to comply with PCI DSS can lead to severe consequences for organizations, including reputational damage exemplified by incidents like the Target breach, loss of the ability to accept credit card payments which critically impacts sales, and financial penalties coupled with mandatory security improvements and assessments by qualified security assessors.
The Payment Card Industry Data Security Standard (PCI DSS) outlines how organizations should protect cardholder data. Most organizations implement best practices from the PCI council to enforce PCI standards, compliance requirements, and vulnerability management.
What happens when an organization doesn’t follow the rules or suffers a data breach due to negligence?
- 1.The organization loses credibility and suffers reputational loss, which can have an immeasurable impact on the bottom line.
- 2.The organization may no longer be able to accept credit cards, significantly impacting its ability to sell products and services.
- 3.The organization may have to pay fines, strengthen its information security, and undergo an independent assessment by a qualified security assessor (QSA). Note that a QSA-performed assessment is required for all level 1 merchants, regardless of compliance.
Reputation
Failing to stay PCI DSS compliant can have far-reaching consequences for a business's brand value. When something bad happens, such as a data breach exposing credit card information, it can severely impact a business’s image and reputation.
For example, in the Target breach, excessive permissions granted to a third party allowed for the theft of countless customers’ cardholder data. While large organizations may have cybersecurity insurance to help mitigate the cost of a data breach, it does little to repair the damage done to those affected.
Although Target would have paid more fines without cybersecurity insurance, the impact on the brand was immeasurable. Stock prices fell for an extended period, and customer visits dropped significantly. Failure to comply with PCI DSS or experiencing a data breach has long-lasting negative brand implications.
Loss of Ability to Accept Credit Cards
Consider how many transactions are conducted using cash or check versus those using payment cards like Visa, Mastercard, American Express, Discover, or JCB. Commerce has become dependent on card payments, and losing the ability to accept them due to a failed PCI compliance assessment or data breach can be devastating.
For brick-and-mortar organizations, the inability to accept payment cards would be a major inconvenience. For e-commerce businesses, losing the ability to accept credit cards could put them out of business. This highlights why PCI compliance is essential for all types of businesses.
Fines, Infrastructure, and Audit
The most damaging effect of failing PCI compliance is the fines, which can range from $5,000 to $100,000 per month until compliance is achieved. Fines are concerning, but so is the fact that many noncompliant organizations lack key infrastructure, information security, and vulnerability management capabilities.
Remediation costs vary depending on how far behind the organization is in following PCI DSS. Additionally, the cost of a QSA audit can be significant, sometimes upwards of $100,000.
PCI DSS provides the necessary direction for organizations to obtain and maintain compliance. Failure to follow these standards can quickly result in non-compliance status. Non-compliant organizations will face fines, loss of market share, and ongoing audits to prove compliance.
It is critical for any business that accepts, transmits, or stores credit card data to follow PCI requirements. A sound information security program and a robust vulnerability management program are essential. PCI compliance is about protecting cardholders, cardholder data, and preventing data breaches. Organizations that ignore these requirements risk becoming cash-only businesses or going out of business entirely.