Fewer than a third of retailers stay compliant between audits
"We see compliance going down day by day, month by month, after the assessment," said Rodolphe Simonetti, managing director for Verizon's compliance consulting. "Compliance is supposed to be supporting security, not just a yearly checklist."
The Payment Card Industry Data Security Standard has 12 main requirements. The most likely to go unmet between audits? The requirement to maintain a firewall and making sure that there is a strong network protection later, said Simonetti.
Not every company drops the ball on this one, he added. But the majority do. "You would expect that companies would test their systems on a regular basis," he said. "But it looks like they're testing their systems on an annual basis. It was really a surprise."
