So what you are saying is that your standard is as inclusive as it can be under the circumstances? That's right. What do you think of questions about the effectiveness of the standard from merchants and even by lawmakers? Certainly, we believe it has been very effective. The standard, as far as we are concerned, is your best defense against a breach. What we have found over the years, and what we have been saying over and over again, is that some of these breaches that you are reading about happened because [the breached entity] turned out to be non-compliant at the time of the breach. I've testified before Congress about some of these things. Basically, what they are saying is, 'If these guys were compliant, why were they breached?' Well the simple fact of the matter is they were compliant at a point in time and when the breach occurred, they were not.

But are the standards adequate for protecting payment card data effectively? At this point, we haven't seen anything in the standard that causes us concern. If I were one of these merchants or a processor or somebody that has been breached, and there was something wrong with the standard, I'd be the first guy to stand up in front a microphone and say, 'Hey the problem with the standard is requirement xyz.' But nobody's doing that. If there is something that is egregiously wrong with the standard, then we would be stressing it at this point. But, again, the simple fact of the matter is that somewhere, somehow [a company that gets breached] was not compliant at the time of the breach.

Why are PCI compliance assessors also allowed to sell security technologies to the companies they do assessments with? Some have said that it creates a conflict-of-interest situation. There are a number of things in our contracts with QSA (qualified security assessors). There are independence clauses in there, for example. A company can sell a solution to a security issue, but when they propose it to a company that they are doing an assessment with, they basically have to say, 'You need this kind of technology to be compliant and we sell one, as well as 15 other people.' They can't come in and say: 'You need to buy our product, otherwise you are not compliant." When a QSA goes in, they give a feedback form to whomever it is that they are doing the assessment for. If the (company being assessed) has any issues with what the QSA is doing or feel like they are being forced into something that they don't want, we encourage them to give us that feedback.