The most significant modification to the Payment Card Industry Data Security Standard (PCI DSS) involves the Level 2 merchant category, which previously only applied to merchants processing between 150,000 and six million Visa e-commerce transactions per year. Level 2 has now been broadened to include all acceptance channels and applies to any merchant processing one million to six million Visa transactions per year. After December 31, 2006, merchants may no longer use the older PCI DSS for compliance validation. Experts estimate these changes have the potential to impact thousands of merchants.

In a released statement about the enhanced standard, Mike E. Smith, , Enterprise Risk and Compliance, Visa U.S.A. senior vice president stated, "Protecting the environment is critical to ensuring the future growth of electronic payments. Extending more rigorous validation requirements to additional merchants better reflects the security risks present in the marketplace."

While none of the broad validation requirements have changed, merchants moving into a new validation level will be responsible for complying with that category’s validation responsibilities. For example, merchants moving from Level 4 to Level 2 must now implement quarterly security scans performed by a qualified independent scan vendor. Also included in the standard for the first time is a listing of Compensating Controls that govern the activities of merchants unable to fully comply with the full PCI DSS 1.1 standard on the aggressive timetable set forth by the PCI Security Standards Council.

Origins and evolution of the PCI Standard

The original PCI data security standard was designed in December 2004 to better protect payment information from theft, fraud, or misuse. Since the PCI initiative was issued, however, enterprise adoption has lagged with fewer than 20 percent of level-1 merchants presently in compliance. These 231 merchants process well over six billion transactions annually. With the potential for fines of over US$500,000 for non-compliance, however, and an expansion in the number of affected merchants, companies are actively seeking solutions to help them respond to the changes.

The PCI Security Standards Council developed the enhanced PCI DSS version 1.1, which is a set of comprehensive requirements for enhancing payment account data security to help facilitate the broad adoption of consistent data security measures on a global basis. This multifaceted security standard includes a core group of principles and accompanying requirements that govern compliance activities of merchants and service providers that store, process, or transmit cardholder data. The PCI Security Standards Council was established to enhance PCI DSS as needed to ensure that the standard includes any new or modified requirements necessary to mitigate emerging payment security risks, while continuing to foster wide-scale adoption. (See the sidebar, Independent Organization Will Create and Maintain PCI Security Standards.)