Simeon Tassev, Managing Director and QSA at Galix. (Image: Galix)
Payment Card Industry Data Security Standard (PCI DSS) compliance has often been viewed as something to focus on only when required, such as when a breach makes headlines or a bank requests proof of compliance. This reactive approach exposes organisations to avoidable risk. PCI DSS sets the minimum baseline for protecting payment data and supports the ability to operate in the payments ecosystem. Non-compliance can lead to fines routed through acquiring banks on behalf of payment brands, and in certain industries it can prevent organisations from securing the licences they need to trade. The reputational damage and loss of customer trust of a payment incident can also be long-lasting and far more damaging than any direct penalty. PCI DSS compliance has become essential for business, not simply an IT task, and organisations need to treat it as such to avoid long-term negative consequences.
Underestimating the importance of PCI DSS is risky business
The importance of PCI DSS is frequently underestimated, largely because organisations question whether it applies to them. If a business, no matter how large or small, processes, stores or transmits cardholder data, either directly or indirectly, then the standard is relevant. There is also a misconception that PCI DSS compliance is complex, which puts businesses off complying. The reality is that PCI DSS focuses on established fundamentals such as network security, anti-malware, patching, secure applications, logging, monitoring and documented policies. These are not advanced or unusual controls; the real challenge lies in maintaining them as part of business-as-usual rather than treating compliance as a once-a-year exercise.
Failing to comply can have serious consequences. Fines vary according to transaction volumes and are routed through acquiring banks, which means they cannot be standardised. While some organisations once chose to budget for non-compliance, that is no longer viable. In South Africa, for example, payment service providers cannot be licensed without PCI certification, and travel agencies require PCI compliance to secure IATA accreditation. In these cases, non-compliance can effectively halt operations. Beyond the immediate financial impact, a breach can result in loss of customers, share-price effects and potential litigation – risks that are difficult to predict or recover from.
Trust, certification and operational discipline
PCI DSS has also become a marker of trust. Many organisations certify to demonstrate their commitment to security and to strengthen their competitive position. This is especially evident in service provider environments such as data centres. When a facility is PCI-certified, auditors can rely on that certification instead of assessing controls directly. When it is not, the burden shifts to the client, making the audit significantly more complex. Certification has therefore become a competitive differentiator.
However, certification alone is not enough. PCI DSS must operate as an ongoing discipline, with controls monitored and maintained throughout the year. This foundation helps organisations manage evolving threats and ensures that security remains aligned with operational requirements. The framework also scales based on transaction volume, making it achievable for smaller businesses through simplified documentation, clear scope and basic risk management. While some risks may be accepted, this brings potential consequences if an incident occurs, and working with the right partners can help organisations maintain effective and sustainable controls.
Building trust and resilience through continuous compliance
When an incident occurs, organisations that can demonstrate established controls, maintain logs and follow an incident-response process are better positioned to protect customer confidence. Social media amplifies scrutiny, making clear and responsible communication essential. PCI DSS supports this by requiring the evidence and processes that enable a credible response.
The standard continues to evolve alongside payment practices. Recent updates, including PCI DSS v4.0 and v4.0.1, strengthen requirements for online transactions, such as secure payment script management, mandatory web application firewalls and enhanced controls against phishing and social engineering, all of which are particularly relevant during periods of high online activity like Black Friday and the festive season.
PCI DSS delivers the most value when it becomes part of daily operations. Maintaining the fundamentals consistently, understanding the environment and partnering with skilled experts to create a secure and trusted payment environment allows organisations to protect their operations, preserve customer trust and build long-term resilience.
