Because I know,
merchants have said to me I'm really worried because I know
everyday I'm not in compliant with DSS.
I know somewhere in my organization, I've got one small failure.
I mean, I'll fix it within one week or two.
Does that mean if I get breached I'm going to be
declared a noncompliant merchant?
That's not the PFI's decision.
The acquirer and the card brands will work together to determine all that.
We just report what we find.
And from the card brand perspective, I'll tell you what we used to do was,
basically,
we would be cross with a merchant if the requirement that
wasn't in place was what led to the breach.
Absolutely.
In other words, had that requirement been there,
the bad guy, or the criminal, wouldn't have done what they did.
You're probably more liable than you didn't have the right policy in place
or Fred hadn't had his information security training,
but that had nothing to do with how you got breached,
yeah?
Yeah.
There's different levels of effort that merchants put into their compliance.
We see merchants that are doing everything they can.
They've hired the right people.
But an attacker that is just that good may get past it.
They get breached.
And the PFI will come in and say, hey, look.
You've done all the things right.
You're compliant in all these.
You still got breached.
It does happen.
And then we have the exact opposite of that where we go in,
and they, basically, grabbed a router from the local office supply store,
plugged it in, and called it good.
And in that case, they're going to fail on those PCI requirements.
Brilliant.
Okay.