Press Release

Verizon Business 2023 Payment Security Report: Top methods, techniques and models to reduce payment security complexity

With the largest change to payment security standards looming, Verizon Business provides guidance on how organizations can best navigate.

Today, Verizon Business released the 2023 Payment Security Report. The 2023 PSR white paper coincides with the approaching compliance deadline of the Payment Card Industry Data Security Standard (PCI DSS) version 4.0. This update to the current PCI DSS standard, is the largest change since 2004. These updates will affect all organizations that store, process or transmit cardholder data, from e-commerce to the public sector.

Compliance with PCI DSS v4.0 is strongly encouraged by March 31, 2024 as v3.2.1 will expire. The standard has numerous updates and 64 new requirements. As organizations navigate this new standard, the 2023 PSR provides the tools to address critical areas in security management program design to not only meet the deadline but also set an organization up for long term success. This includes the role of PCI security integration into larger corporate governance, risk management, and compliance initiatives as well as the tools needed for modern program design.

“Compliance is often seen as an added complexity to an already challenging task of securing digital payments in the face of evolving threat actor capabilities.“ said Kris Philipsen, Managing Director of Cybersecurity Consulting at Verizon. “Fortunately, highly effective methods to achieving payment security compliance exist and have been outlined in the Verizon Payment Security Report that not only help make PCI DSS v4.0 outcomes highly predictable, but moreover allow organizations to achieve breakthrough performance enhancements in security program design.”

The 2023 PSR helps to guide organizational leaders through designing and managing a PCI security compliance program, offering adaptable models for organizations to use. The report also notes leading management methods for identifying and overcoming the most significant constraints, providing a process for clarifying root causes of poor security program performance.

“The March 2024 retirement date for PCI DSS v3.2.1 is rapidly approaching,” says Lance Johnson, Executive Director of PCI SSC. “PCI Security Standards Council is committed to helping organizations understand the latest version of PCI DSS. To do this, the Council has created a PCI DSS v4.0 Resource Hub, which houses resources to help organizations better understand the Standard. By understanding what PCI DSS v4.0 means for your organization, you can take the necessary steps to achieve a smooth and efficient transition.”

The top five insights businesses need to know:

  1. As PCI DSS requirements evolve, so should security programs.
  2. Data security and compliance success is achieved by design – not by luck.
  3. Leading management methods simplify program management complexity, helping organizations to be economic and achieve more with less.
  4. Organizations should design security programs to focus on what matters most, and overcome the most important constraints.
  5. An integrated program management design can be applied to new programs and vastly improve existing programs.

Read the Verizon PSR 2023 white paper, and learn more about the best practices for organizations to implement the PCI DSS 4.0.

About the Verizon Business 2022 Payment Security Report

Verizon published the industry’s first analysis on the global state of compliance of PCI DSS in the 2010 Verizon PCI Compliance Report, now called the Payment Security Report (PSR). Based on global data gathered by qualified security assessors (QSAs) from Verizon and other external contributors, with additional comparisons between geographic regions (Americas, EMEA and APAC), the report explores why some companies accomplish more than others in their efforts to achieve sustainable and effective data security. Since its inception, the PSR has tracked compliance ups and downs, while keeping a finger on the pulse of the changing payment security landscape.

Leave a Response