So I am in the middle of working on a rather large project at the moment, and in the course of my work, I am constantly barraged with the notion that to achieve corporate goals associated with security we must meet regulatory compliance; especially PCI (Payment Card Industry… not peripheral component interconnect) compliance.

Before anyone gets upset with me, let me state that I think that the PCI-DSS is a well thought-out and clearly articulated set of standards that are good to measure a company’s approach to securing their customers’ data against. Unfortunately, there are those who believe that the height of the security pinnacle is passing a PCI audit, and that if this can be achieved, no further spend or effort is required.

Pointing out that companies like Hannaford were, in fact, PCI compliant during the time of their breaches seems to do little to sway the proper folks.

So my approach has been to speak to PCI as if it is a baseline, rather than a high-bar.