Mastering the Payment Card Industry Standard: Private Framework Seeks to Shield Credit and Debit Card Account Information

[ILLUSTRATION OMITTED] EXECUTIVE SUMMARY * Becoming familiar with the Payment Card Industry Data Security Standard is a prerequisite to understanding the regulatory environment in which many businesses that accept credit and debit cards operate. * PCI dovetails with a CPA's core competencies in attest work, risk management, internal audit support and fraud prevention. * PCI is not a standard affecting only merchants and card issuers. Through its three frameworks, it sets new standards of reasonable care and responsible safeguarding of cardholder data throughout many sectors of the economy. Simply accepting debit or credit cards or outsourcing such functions can trigger responsibilities to safeguard data or properly oversee business partners. * PCI is a different animal from Sarbanes-Oxley or SAS no. 70, Service Organizations, and requires separate investments. Fulfilling the demands of the standard may require sophisticated access control, activity logging and data encryption. ********** In January 2007, TJX Companies Inc. began notifying its customers and business partners along with regulators and law enforcement agencies that it suspected someone had hacked into an area of the company's computer network that held data from credit card, debit card and check transactions and pilfered sensitive information. TJX, the parent company of retailers T.J. Maxx and Marshalls, first reported that the hacking might have affected more than 45 million accounts. The tally of affected accounts may be closer to 94 million, according to documents in a law suit filed by banks and banking associations against TJX and Fifth Third Bancorp, the bank that handled its card transactions. The highly visible breach has been costly for the company's reputation and balance sheet. In September, TJX agreed to settle customer class action lawsuits in the U.S. and Canada related to the security breach. Estimated costs for the settlement and other expenses stemming from the crime were reflected in TJX's second quarter filing as a charge of $118 million and an estimated future charge of $21 million. One question asked in the wake of the TJX breach was whether the retailer complied with the Payment Card Industry Data Security Standard (PCI DSS) at the time of the attack. When a card fraud or breach occurs within a business, the five major credit and debit card corporations--Visa Inc., MasterCard Worldwide, American Express, Discover Financial Services and Japan Credit Bureau (JCB)--use the standard as the starting point for determining compliance and potential liability. The standard is now the metric through which global credit and debit card organizations define standards of due care. While complying with the standard is not required by law, businesses of all sizes that accept cards as payment and those that process card transactions must meet the requirements as a condition of doing business with the five major payment card networks. They also must provide each credit card company they work with proof of their compliance with the standard. Regardless of whether or not a business suffers a data breach, failing to live up to the core data security framework of the standard can, under the terms of a business's contract with a payment card company, result in sanctions, increased audits or bans prohibiting businesses from issuing or accepting credit or debit cards or otherwise playing a role in such transactions. For financial institutions that authorize a merchant to accept credit card payment, working with noncompliant businesses can result in fines levied by credit and debit card networks. CPAs who serve financial institutions that play a role in card transactions or merchants that accept credit or debit cards must be knowledgeable about the standard. This article will highlight PCI's major components and the role CPAs can play in its implementation. …

Récupéré en direct depuis OpenAlex et désinversé. Les résumés ne sont pas conservés dans cette base de données : les index inversés représentent 8,6 Go des 9,3 Go de texte de la base, et le serveur dispose de 13 Go libres.