Among the 11 security deficiencies with which TJX was charged: It failed to comply with the PCI standards for data and computer security. This global security standard is a product of the PCI Security Standards Council, created in September 2006 by the five major card brands: American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa. According to Bob Russo, PCI's general manager, the council's main goal was to create "one answer for all five brands." It also seeks to educate companies and has taken on the vital tasks of qualifying and managing the auditors who must certify merchants' compliance (known as qualified security assessors or QSAs), and qualifying approved scanning vendors (ASVs), who test system security by running simulated customer transactions. The council is also building a lab to test and validate the security of pin-entry devices.

Despite any relief merchants may feel by only being held to one merged standard, DSS remains a throbbing toothache for many CIOs in charge of payment card transaction systems. Compliance, verified by stated deadlines, is mandatory. The New Year's Eve deadline looms for full compliance by mid-market merchants. Fines threaten, but it's hard for merchants to predict just what they might cost because they are levied by the individual card companies who have their own rules and rates (Visa may fine one amount and MasterCard another). Complicating matters further, these fines are not directly charged to merchants but to their card-processing banks. The banks then choose to either pass them along, absorb them or, in some cases, even increase them.

Other punitive measures are possible, including having card processing privileges revoked or, as in the TJX example, justification for lawsuits.

Most analysts agree that the majority of companies are not yet certified, though the exact numbers are hard to pin down. In an October news release, Visa announced that 65 percent of the largest merchants had been verified as compliant. Shniderman of Deloitte Consulting puts the level for midsize merchants at only 40 percent to 45 percent.