FTC To Study Credit Card Industry Data Security Auditing

The Federal Trade Commission has issued orders to nine companies requiring them to provide the agency with information on how they conduct assessments of companies to measure their compliance with the Payment Card Industry Data Security Standards (PCI DSS).

PCI DSS audits are required by the major payment card issuing companies of retailers and other businesses that process more than 1 million card transactions in a given year, and are intended to ensure that companies are providing adequate protection to consumers’ sensitive personal information.

The nine companies receiving orders from the FTC are: Foresite MSP, LLC; Freed Maxick CPAs, P.C.; GuidePoint Security, LLC; Mandiant; NDB LLP; PricewaterhouseCoopers LLP; SecurityMetrics; Sword and Shield Enterprise Security, Inc.; and Verizon Enterprise Solutions (also known as CyberTrust).

The FTC is seeking details about the assessment process employed by the companies, including the ways assessors and companies they assess interact; copies of a limited set of example PCI DSS assessments, and information on additional services provided by the companies, including forensic audits.

Information collected by the FTC will be used to study the state of PCI DSS assessments.

The Commission is authorized to issue Orders to File a Special Report by Section 6(b) of the FTC Act.  

The Commission vote to issue the orders was 4-0.

The Federal Trade Commission works to promote competition, and protect and educate consumers. You can learn more about consumer topics and file a consumer complaint online or by calling 1-877-FTC-HELP (382-4357).  Like the FTC on Facebook, follow us on Twitter, read our blogs and subscribe to press releases for the latest FTC news and resources.