--Proposed Legislation Would Make PCI Standard the Law in Texas
(May 14, 2007)
Texas's House of Representatives has unanimously approved a measure that
would make compliance with the Payment Card Industry (PCI) Data Security
Standard a state law.  HB 3222 would force companies that suffer a
breach to reimburse banks and credit unions for costs incurred in
blocking the use of compromised cards and issuing new ones if that
business was not PCI compliant at the time of the breach.  Companies
that suffer breaches while in compliance would be protected under a safe
harbor provision.  The bill needs to win approval in the Texas Senate
before it becomes law.
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9019361&source=rss_topic17
[Editor's Note (Schultz): This is a very interesting turn of events. I
am confident that those who wrote the PCI-DSS standard never envisioned
this happening. Although PCI-DSS is far from perfect, legally requiring
conforming to it would nevertheless appreciably boost security within
companies that issue credit cards.
(Pescatore): This sounds like a major mistake. Merchants already bear
the brunt of the costs of credit card fraud and breaches - the card
issuers and card associations are no way entitled to a free ride here.
While the PCI process has many good elements, it also is in tremendous
need of improvement in the actual levels of security mandated and
especially in the governance of the assessments and compliance granting.
(Paller): PCI, despite its flaws, is a much, much more valid and
reliable standard for protecting sensitive information than are NIST's
standards. Multiple PCI auditors get the same answer and they are
looking at the most important things. Neither can be said about FISMA
auditors using NIST standards. If NIST recommended the PCI audit guide
as an acceptable method of meeting the NIST standards, security in the
US government would surge forward. The same is true of ISO standards.
An improved version of the PCI audit guide (particularly including
improvements recommended by John Pescatore) should be the audit guide
for minimum acceptable behavior under the ISO standards.]