Filter by Category

10 Shocking PCI DSS Compliance Statistics

If you work for any organization that processes credit or debit card information, you’ve heard of the Payment Card Industry Data Security Standard (PCI DSS), the regulatory standard aimed at preventing costly data breaches like the ones you may have heard about at Home Depot or TJX. But how much do you really know about PCI DSS compliance? Here are some interesting PCI DSS compliance statistics you may have missed.

 

1. PCI DSS compliance has increased by 167% since 2012

This is the best news on the list. According to Verizon’s latest PCI DSS Compliance Report, the number of organizations that are fully compliant at the time of interim assessment is growing rapidly each year.

 

PCI DSS statistics infographic2. 80% of organizations are still not compliant

While the increase in businesses taking PCI DSS compliance seriously is important, the number of compliant organizations was very low to begin with. According to Verizon’s report, four out of five companies still fail at interim assessment.

 

 

3. Only 26% of news media executives feel confident their businesses are compliant

Newscycle Solutions survey found that only a small number of executives felt confident they had achieved PCI DSS compliance. Another 13 percent were not certain. While this compliance statistic is a snapshot of a specific industry, it’s common across all types of organizations to feel unsure about meeting PCI DSS standards. IT infrastructure becomes more complex every day, PCI DSS rules change frequently, and many companies lack up-to-date expertise.

 

4. Only 29% of companies are compliant a year after validation

Many businesses check PCI DSS compliance off the list and then stop worrying about it. Unfortunately, less than a third have maintained compliance a year later. While successfully demonstrating PCI DSS compliance to an auditor is a big relief, it won’t keep your business safe from security threats. The Verizon report recommends building a robust framework with security policies, procedures, and testing mechanisms to ensure compliance every day of the year.  

 

5. You could pay $100,000 a month for being non-compliant…or much more

One of the least understood aspects of PCI DSS compliance is that the fines for non-compliance are levied on the payment processors or credit card companies (the acquirers) that work with the non-compliant business, not the business itself. Those fines range from $5,000 to $100,000 a month. Of course, the acquirer will recoup the money from you, quite likely with added penalties and increased transaction fees.

 

6. None of the companies breached during Verizon’s investigations were fully compliant

This statistic is just in case you thought that PCI DSS standards were only important for your auditors. In Verizon’s ten years of having a forensics team investigate PCI DSS compliance, they have never found a company that was fully PCI DSS compliant at the time it was breached. Take note.

 

7. 39% of organizations were breached through insecure remote access

A 2017 study from SecurityMetrics reported that in 2016, the largest single origin of compromise was through insecure remote access. PCI DSS regulations recognize remote access as a vulnerability, and instructs organizations to protect against breach via remote access by implementing “two-factor authentication for remote access to the network by employees, administrators, and third parties,” in requirement 8.3.

 

8. The average total cost of a data breach is $4 Million

According to the Ponemon Institute, which tracks the costs of data breaches every year, the current amount is up 29 percent since 2013. Refer to #6 for why this statistic directly relates to your PCI DSS compliance.

 

9. 69% of consumers would be less inclined to do business with a breached organization

According to Verizon, the majority of consumers would be hesitant to do business with an organization that has suffered a data breach. If you’re having trouble justifying the cost of robust security solutions, this is what you need to think about: being complacent about PCI DSS compliance today could lead to years of lost customers and a damaged reputation for your brand.

 

10. The average merchant, at the time of data compromise, wasn't compliant with at least 47% of PCI DSS requirements

Stemming from statistic number six, the 2017 SecurityMetrics study also found that the average breached merchant was not compliant with a significant percentage of PCI DSS requirements at the time of breach. The study supposes that this lack of compliance is attributed to a lack of trust in the effectiveness of these regulations, or a believe that PCI requirements are too technical or too costly to implement.

 

What's new in PCI DSS 3.2It’s clear that many organizations are struggling with PCI DSS compliance. It doesn’t have to be difficult. Seek out security software solutions that protect your valuable data using up-to-date methods, generate detailed logs to keep auditors happy, and allow you to easily test for PCI DSS compliance.

The next set of PCI DSS deadlines are coming in 2018. Is your business prepared? Read this whitepaper to learn what changes are necessary before the 2018 deadline.

 

Comments (1)

  1. Bill Brown:
    Jun 30, 2018 at 08:00 PM - Unapproved

    Security Metrics cannot provide a written guide to assist with completing any PCI Questionaire. I have reviewed both the questions on the questionaire and the internet for manuals listing even basic information to fill out the questionaire and have not found one document . I have found plenty of companies wiling to take my money for their guidance. Ever try taking a test without knowing the correct answer to the question? That is the pci compliance game.

Add a Comment

Allowed tags: <b><i><br>

Latest Posts


What is Managed File Transfer (MFT)?

October 10, 2018

As companies recognize a need for a solution that meets their file transfer, automation, and encryption needs, the question often arises: what is managed file transfer and how is it different from my…


Why You Should Cluster Your File Transfer Systems

October 4, 2018

What’s the true cost of downtime for your organization? You may think of it in terms of lost revenue—according to studies released in the last couple years, the average cost of…


4 Healthcare Organizations that Use Managed File Transfer

September 28, 2018

Earlier this year, GoAnywhere covered five of the healthcare industry’s top cybersecurity concerns for 2018 and addressed how those risks could be mitigated. Now, almost ten months into the…


Which is Better: SFTP vs. FTPS?

September 24, 2018

How do you transfer sensitive files? Business requirements and security standards have increased in recent years across industries and continents, but many organizations have struggled to keep up.…


Tradeshow Recap: VMware 20th Anniversary, Secure File Transfers, and More at VMworld 2018

September 10, 2018

Dazzling booth displays and nerdy Star Wars swag. Informative training sessions. Demos for modern software and hardware. Drones. In-depth industry conversations. Coffee decorated with techy latte…