Despite the difficulties, Keller seems satisfied with the standard and the process. "PCI gave us a great security checklist and a great place to start. And by going through the 12 different requirements, it allowed us to ensure that we have adequate protection around the data that we have."

Never-Ending Deadlines

You'll never be finished with compliance. Even after your company meets the current standards and sets up the quarterly cycle of scans and reports, you can expect new requirements to address new threats. And with them, new deadlines.

Russo explains that the PCI Council will "make changes in the standard on the fly" as a way of responding flexibly to new threats. How long merchants will have to respond depends on the type of change. A simple patch might be required immediately. Major changes, such as the new Web and enterprise application code audit requirement due June 30, 2008, will get companies a year to 18 months' grace period."The object of releasing a new standard is not to put anyone out of compliance when we release it," assures Russo.

While penalties are the stick of PCI, brand confidence may be the carrot. In the event of a security breach, you have your customers and your brand suffering a tremendous amount of damage. Or so runs conventional wisdom.

But customer confidence proves to be notoriously fickle. Take TJX. Following its data breach disclosure, the company reported two consecutive, highly successful quarters. To some observers, the fact that TJX has not suffered serious consequences makes the carrot of customer confidence a harder sell. Says Keller: "Think of the PR, especially for an organization like ours. What if we have this huge data breach? Yet here's TJ Maxx, a well-known brand. They have this huge breach and yet they have one of their best quarters ever."

Shniderman cautions IT leaders to be careful of how they interpret TJX's good fortune. "You can read a couple of things into that," he says. "Some consumers are willing to increase their vulnerability to get a good discount," he says.

TJX might have changed their pricing or promotions during the period after the breach, or they may simply have addressed the crisis effectively, continues Shniderman. "If you have a fraud-compromising event, it's a moment of truth. The trust level goes down significantly if you don't address it well."

Whether or not customer confidence can be managed after a breach, it's a safe bet that no company wants to suffer one. And while PCI DSS 1.1 will not plug all potential security leaks, it's now a necessary cost of doing business.

Michael Jackman writes frequently about computer security. Contact him at mjackman@mjfreelancer.com.