SHARE

More Firms Meeting PCI DSS, but Only Temporarily

PCI DSS PCI DSS Compliance Trends Over the past three years, overall average compliance grew from 53% to 94%, an increase of 77%. Over the same period, full compliance increased from less than 8% to 20%, a 167% change. PCI DSS Compliance Improves Somewhat in 2014 The number of organizations that achieved full compliance grew […]

Written By

Michael Vizard

Apr 6, 2015

Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

PCI DSS

PCI DSS Compliance Trends

Over the past three years, overall average compliance grew from 53% to 94%, an increase of 77%. Over the same period, full compliance increased from less than 8% to 20%, a 167% change.

PCI DSS Compliance Improves Somewhat in 2014

The number of organizations that achieved full compliance grew from 11% in 2013 to 20% in 2014, reducing the number that were non-compliant from 89% to 80%.

State of PCI DSS Compliance

More than 90% of all controls, subcontrols, and testing procedures were passed by 80% of companies, a significant increase from last year. Only 25% were passed by all companies assessed, and the highest any control scored in 2013 was 98%.

The Nature of PCI DSS Compliance

On average, compliance with 11 of 12 PCI DSS requirements increased 18 percentage points. The biggest increase was in authenticating access. The only area where compliance fell was testing security systems.

Reduction in Scope

A full 87% reported making some effort to take data out of scope for PCI DSS compliance using a variety of methods. Another 62% reported moving affected data beyond their control by relying on third-party providers. A full 96% are also using firewalls and routers to control access to data.

Spear-Phishing the Password

Four out of five breaches stemmed from authentication-based tactics, where attackers attempted to guess, crack or reuse valid credentials.

Unencrypted Data Is Primary Target

Attackers often focus on compromising stored data. Almost half (48%) of compromises related to payment card data breaches involved data that was unencrypted.

Use of Anti-malware Software

This is the only control category that witnessed a drop in compliance, from 96% to 92% in 2014.

Managing the Insider Threat

A full 96% of companies were compliant in limiting data access to just those individuals whose job requires such access.

The Ultimate Fail

Of all the data breaches investigated by Verizon in the last 10 years, not a single company has been found to be fully compliant at the time of the breach.

Michael Vizard

Michael Vizard is a seasoned IT journalist, with nearly 30 years of experience writing and editing about enterprise IT issues. He is a writer for publications including Programmableweb, IT Business Edge, CIOinsight, Channel Insider and UBM Tech. He formerly was editorial director for Ziff-Davis Enterprise, where he launched the company’s custom content division, and has also served as editor in chief for CRN and InfoWorld. He also has held editorial positions at PC Week, Computerworld and Digital Review.

More Firms Meeting PCI DSS, but Only Temporarily

Michael Vizard

Recommended for you...

Company

Categories