3 ms·
> Actually this makes a pretty good case for this regulation being a joke. PCI-DSS is not government regulation, but an industry created and enforced standard.
by shkkmo 7y ago
> Actually this makes a pretty good case for this regulation being a joke.
PCI-DSS is not government regulation, but an industry created and enforced standard. Compliance is not mandated by federal law and only a couple of states have laws that reference it. For example, Nevada requires compliance while Washington doesn't require compliance but does remove liability for breaches for compliant businesses.
- monadic2 7y agoI meant it in a looser sense (like “constraint” I guess), but it just reinforces the reputation that PCI-DSS is a checklist you can buy, not meaningful itself.