How To Sell PCI To Business Units

Written by Evan Schuman
August 14th, 2008

Guest Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.

At this week’s National Retail Federation CIO conclave, NRFtech, the CIO of J.C. Penney presented the keynote, which focused on the top five priorities for the business and the technical implications of these priorities. PCI compliance, perhaps not surprisingly, was one of these top five priorities.

During the discussion, the CIO, Thomas Nealon, commented that one of the biggest challenges when it comes to PCI is explaining to businesspeople why it’s a priority. This is a common refrain among merchants of all types and sizes. Because there are a lot of examples of this in the Knowledge Base, I thought we could discuss some of them, so that others may be able to use them in their own companies.

  • Yell "SECURITY BREACH" really loudly, all the time. A somewhat less extreme version of this is actually pretty common among merchants. Although it can be effective in some cases, it works best as a motivator of businesspeople if you can cite specific statistics and/or industry peers who have been breached. For the statistics themselves, check out, which is hosted by the Open Security Foundation.

    However, like crying "Wolf," or talking about the end of the world, this only works for a short period of time. In addition, the use of this tactic can backfire if someone decides to cite the latest financial results from TJX as "proof" that security breaches have no discernable negative impact on revenues. So, although fear of a security breach can get business people to come to a meeting, you’ll need a "second act" to keep them in their seats.

  • Relate PCI to customer care. Businesspeople recognize that customer data is an asset of the business. But they assume that it’s already being protected. After all, they’ve been "paying the freight" for the IT organization for years, and they assume that part of that money goes to customer data security. So the task is getting them to see that more security is needed, without making the CISO look incompetent. The best retailers we’ve talked to address this by demonstrating the pervasiveness of customer data—specifically credit card data—and pointing out that the more data the merchant has, the more it will cost to protect that data.

    Another tactic we’ve seen used effectively is to talk about the marketing value of being a PCI leader. Although PCI compliance doesn’t make for exciting TV advertisements, making sure customer service representatives—as well as sales and marketing—can explain to customers how their data is secured is a handy message to help get businesspeople to connect PCI with customers.

  • Show threatening letters from the merchant bank. In most cases, the dollar cost of the fines levied by the card brands, through the acquiring banks, is not sufficient to excite businesspeople. But the thread of interchange fee "downgrades" can cost a merchant millions of dollars per year. Obviously, the CFO does not enjoy receiving letters threatening fines or downgrades. This makes the CFO a major ally in getting business units to pay attention. Sometimes this happens in a meeting among the CEO, CFO, CIO and the business unit heads, and other times it’s much more subtle, like when PCI becomes a "priority project" of the CFO rather than the CIO.

    But it’s still necessary to get line management to care, because they have to make changes to business processes, re-train staff, etc. Working with Internal Audit can facilitate this process, because they usually report to the CFO. Some of the best "perpetual PCI" solutions we’ve seen involve Internal Audit, working with IT security for added technology cross-training, serving as the "big stick" to get business departments and store management to make PCI a top priority.

  • Hand PCI to the Project Management Office (PMO). In some cases, it’s not Internal Audit or IT or even Information Security that drives the PCI bus; rather, it’s the corporate PMO. Because the PMO often reports to the CEO, CFO or COO, the office can be a major mover and shaker for PCI. But getting PCI on PMO agendas isn’t easy; the office often has an Operations focus rather than an IT focus.

    Selling PCI to the PMO is typically done by the CFO or COO as a delegation, but it can also be handled via a subtle handoff of a "high visibility, high reward" program. The PMO is a good organization to work with in the early stages of PCI compliance, but the job needs to be shifted elsewhere (Internal Audit or Information Security or Business Operations) after that.

  • Hire a security geek with a sales background. This just illustrates how difficult it is to try to run PCI solely out of IT or IT security. There are just too many changes needed to how the company does business for an IT person who has never visited stores and who typically knows one specific area of technology very well (and others not-so-much).

    Technologists are often at a loss when it comes to convincing businesspeople to change how they run the organization. This is not to say it cannot be done, but it’s much better if the IT organization can enlist the aid of the PMO and/or Internal Audit to work with the business people on addressing the operational implications of PCI.

  • The ROI of PCI. One final thing: We’ve talked to some organizations where fraud reduction is a key business driver of PCI. Essentially, they have developed models that connect specific PCI-mandated controls (not all of PCI) with a reduction in credit card fraud. The implication is that these merchants can "prove" that "PCI Saves Money," which is not a phrase one hears very much but is still very helpful in convincing businesspeople to support PCI compliance efforts. But most merchants are not in a position to connect PCI compliance to a reduction in fraud. We are still working on this research and would like to discuss this issue with any reader who has experiences in making this connection.

    By the way, if you’re a retailer, we want to get you involved in the best practices study we’re doing for the National Retail Federation. If you’d like to participate, send me an E-mail at

  • advertisement

    Comments are closed.


    StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

    Most Recent Comments

    Why Did Gonzales Hackers Like European Cards So Much Better?

    I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
    Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
    A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
    The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
    @David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

    Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.