Five major credit card companies Thursday announced the formation of an independent body to oversee the development and maintenance of the Payment Card Industry (PCI) data security standard. American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International have thrown their weight behind the newly formed PCI Security Standards Council.

Aimed at retailers and companies that process credit-card data, the PCI standard is a set of technology requirements for securing networks and applications, protecting cardholder data, maintaining a vulnerability management program, and regularly validating compliance via a third-party assessment. It was designed to consolidate what in the past have been a bunch of different security guidelines from credit card companies.

But merchants have complained about ambiguities in the PCI standard and compliance hardships since the rules went into effect in June 2005. As of this spring, only 22% of the largest merchants were PCI-compliant, according to Visa estimates.

With the formation of the PCI Security Standards Council, its founding members hope to develop a system that is more accessible and efficient for merchants, processors, point-of-sale vendors and financial institutions. The council's charter tasks include:

* Developing and maintaining a technical data security standard for the protection of account information;
* Reducing costs and lead times for compliance by establishing common technical standards and audit procedures;
* Providing a list of available, qualified security solution providers to help the industry achieve compliance;
* Providing a single source for certifying qualified security assessors and approved scanning vendors; and
* Providing a forum in which stakeholders can provide input into the ongoing development, enhancement and dissemination of data security standards.

As its first action, the council released the PCI Data Security Standard version 1.1. The new version addresses evolving security threats and provides a framework for ongoing PCI compliance.

The formation of the council and release of the new standard are welcome advances, industry watchers say. In the past, a lack of clarity has left companies struggling to comply with PCI, says Jennifer Mack, director of product management at security vendor Cybertrust.

Whitepapers

• The ROI and TCO Benefits of Data Deduplication for Data Protection in the Enterprise
• Best Practices in Lifecycle Management: Comparing KAC(tm), Altiris, LANDesk, and Microsoft SMS
• Security vs. Flexibility: Must IT Management Choose?
• Systems Management Buyer's Guide For Medium Enterprises
• The Trend from UNIX to Linux in SAP(r) Data Centers
• Vulnerability Management For Dummies

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• The Secure Web Gateway. Mission Critical For Business - Webcast
• Mobile Data Security
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives

View more SECURITY webcasts

Special Reports

• IT Buyer's Guide to Security Information Management
• The Evolution of Network Security
• IP address management in 2008 - six things to know
• The self-managed network

View more SECURITY special reports