PCI Security Standards Council
More info
- Creator
- American Express, Discover, JCB, Mastercard, Visa
- Released
- 2006
- Type
- Standards body
- Website
- pcisecuritystandards.org
The body the major card networks set up to write PCI DSS and its sibling standards — and which punishes precisely no one for breaking them.
Before the council, each network ran its own security programme, Visa's CISP and Mastercard's SDP being the biggest. They were merged into PCI DSS 1.0 in December 2004, and in 2006 American Express, Discover, JCB, Mastercard and Visa formed the council to maintain it. Based in Wakefield, Massachusetts, it now also owns PIN Security, PTS, P2PE, 3DS and the Software Security Framework, and it certifies the assessors: QSAs for audits and ASVs for vulnerability scans.
What many people miss is that the council has no enforcement powers. Fines and terminations are handed out by the card networks, through acquirers, under their own rules. The council writes the standard; the networks hold the stick.