The aquarium's road to compliance began in September 2006, when its merchant bank asked for an update. Merchant banks process payment cards and are the middlemen between the payment card companies and the merchants.

The 12 top-level standards quickly subdivide into finer levels of detail. For instance, Requirement 8: "Assign a Unique ID to Each Person with Computer Access" contains five sub-steps, with step 8.5 divided into 16 more. In response to this requirement, Keller moved his admissionssystem away from one common "extremely restricted" login used by everyone working the ticket booth, to separate IDs for each employee. Internally, he now tracks users by PC as well as by their job function, so that their network access across the system can be logged. As required by PCI, passwords change every 90 days. Keller also added an intrusion detection system and revised information security policies to make them more easily understandable.

Keller decided to do his own compliance work in-house, but it wasn't his first choice. First he approached consultants specializing in PCI DSS, but he had difficulty finding a firm willing to take full accountability for its decisions.

Many consultants claim to be working on behalf of PCI, but "none of them will sign next to you on your audit questionnaire," explains Keller. "So if they won't stand behind me and sign on the line in case of a breach, why should I pay them any money in the first place?" Keller does use an approved QSA, Fishnet Security, for the quarterly security scans and penetration testing required by PCI for all merchants with more than 10,000 transactions a month. The results are forwarded to the National Aquarium's merchant bank. As the company develops new applications, the QSA consultant will also analyze the code for security compliance as part of the development process. The requirement to test new code has a deadline of June 30, 2008.

When it came to interpreting the standard, one area in which he and the auditors disagreed was with the proper way to secure a proprietary wireless bridge between two buildings.

"Some [auditors] will say even though there's no credit card traffic passing through that it still needs to be segmented off with hardware firewalls. And to me, I cannot see a valid need for doing that when the wireless network itself is proprietary. So I think there are opportunities where the standard can be taken a little bit too far."