Evan Schuman's StorefrontBacktalk

My answer is that I doubt it. The card brands hold processors and service providers to a higher standard and, in my opinion, this situation is appropriate. For example, a service provider with just 300,000 annual transactions (by brand) needs an outside assessment by a QSA. A merchant with the same number of transactions would be a Level 4 and could self-assess.

Another factor is that merchants are not in the payments business; they sell stuff to consumers. Processors and other service providers are in the payment business. That means processors are, and should be, held to a higher standard than merchants both because card processing (and security) is their core business and because any data breach at a processor is likely to involve many more compromised PANs.

My third question: Does Visa know something that it is not telling us?

To the best of my knowledge, Visa has not revoked the compliance status of a processor for many years. I am sure it did not make lightly a decision that could have such a negative business impact on Global Payments.

There is a lot we don’t know about the breach. Based on what I’ve read (I have no first-hand knowledge), we still are not sure of the timing, size or extent of the breach. We also should acknowledge that it is highly likely that Global Payments was not PCI compliant at the time of the breach (a factor that is relevant in considering my first question) and that the source of noncompliance likely contributed to the breach. Nevertheless, if Visa has some additional information to support its decision, I hope it will make that knowledge public.

Another question for merchants: If Global Payments is my processor, what should I do?

The short answer, at least initially, is to be a pest. Contact the company and keep at it until you get some direct answers. Global Payments made it clear it was the source of the breach and not any individual merchant, so you will have to get answers from the processor. It created a Web site and its merchant customers should check it regularly. Remember, too, to monitor security and news Web sites—and especially, where else?: StorefrontBacktalk—for any breaking developments.

Customers need to know when Global Payments will get back in Visa’s—and the other card brands’—good graces. That is, what are the processor’s plans and timing for returning to the list of PCI-compliant service providers?

Depending on how long that process takes, merchants may feel pressure to start thinking about whether to find an alternate processor. The only advice I can give as a QSA is to monitor the situation and follow your Incident Response Plan procedures. Naturally, you included a third-party breach in your IR plan, right?

What do you think? I’d like to hear your thoughts. Either leave a comment or E-mail me at wconway@403labs.com.