Beyond PCI DSS
compliance:
assessingand shrinking
enterprise risk
An expert’s guide for
Security Leaders in the
APAC region
By John Hines, Head of Cyber Security, APAC, Verizon

With Asia-Pacific (APAC) on track to become a $1 trillion
digital economy by 20301, mainly driven by the surge incashless and instant payments, Chief Executive Officers,
Chief Financial Officers, and Chief Information Security
Officers remain anxious about the implications of mandatory
data breach reporting and the forthcoming implementationof the global and universal Payment Card Industry Data
Security Standard (PCI DSS) v4.0.
In a climate of uncertainty, Verizon advisory services can help
businesses address these compliance challenges.
As a security leader, your task is challenging: You’re in a region hit
by over a third of all cyber attacks worldwide2, making it the mostfrequently targeted region in the world.
Financial services are the second most attacked sector, with 9 out
of 10 attacks targeting Japan3.
With PCI DSS v4.0, we’re tackling not just technical hurdles– 64 new requirements4 – but also the weight of shareholders’expectations in larger companies, demanding greatertransparency and security regarding data breaches and zerotrust progress.
In Australia, the penalties faced by CEOs for failure to safeguard
their organisations’ data effectively are higher than ever before,
with the Office of the Australian Information Commissioner (OAIC)
flagging a steady increase in data breach notifications at the endof 20235.
In one recent APAC incident, a Singaporean online retailplatform6 experienced a significant data breach exposing
the credit card details of 2.76 million customers, leading tounauthorised transactions and financial losses.
The company then suffered reputational damage and potential
regulatory fines, emphasising the high stakes of data security inthe digital payment ecosystem.
This breach highlights four specific gaps in the retail company’s
cybersecurity approach when matched to PCI DSS v4.0
standards (which total 12 core data security requirements)

1. Requirement 3 (protect account data): Failure to adequately
encrypt or mask stored payment data.
2. Requirement 7 (restrict access to cardholder data):
Insufficient access control measures allow unauthorised
access to sensitive information.
3. Requirement 9 (physical access to cardholder data):
Lapses in securing physical systems and environments wherecardholder data is processed or stored, leading to potential
unauthorised physical access.
4. Requirement 11 (security testing): Inadequate regular testingof security systems and processes exposes enterprises tobreaches and further vulnerabilities.
While this data breach example shows specific gaps incompliance, the more significant problem is building a unified
and efficient approach to compliance and risk management thatdynamically evolves over time.
Many businesses are operating with fewer resources, often using
trial and error to meet the requirements for a standard designed
to protect cardholder data across merchants, third parties andcustomers.
Add in inadequate stakeholder buy-in, unclear program objectives
and underestimation of the program’s complexity, and it will likely
become more difficult to keep up and stay systematically ahead of
security standards.
Ongoing protection of payment data requires maintaining existing
security controls while implementing changes for PCI DSS v4.0.
Over half of all big companies worldwide, earning over US$10
billion annually, faced fraud in the last two years. Even more
shocking, about one in five of these companies said their biggest
fraud issue cost them over $50 million7.
Unless you make disclosure and compliance your north stars
today, you risk crippling your company during a period of massive
digital uncertainty.
However, embracing a focused action plan for compliance allows
enterprises to implement performance enhancements in security
program design.

1 https://www.cnbc.com/2023/11/29/southeast-asia-may-be-on-the-cusp-of-a-cashless-payments-revolution.html
2 https://www.ptsecurity.com/ww-en/analytics/asia-cybersecurity-threatscape-2022-2023/
3 https://www.verizon.com/business/resources/reports/verizon-vision-for-banks-enterprise-intelligence-anz.pdf
4 https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf
5 https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-breaches-publications/notifiable-data-breaches-report-july-to-december-2023
6 https://www.pdpc.gov.sg/all-commissions-decisions/2023/03/breach-of-the-protection-obligation-by-eatigo-international
7 https://www.pymnts.com/news/b2b-payments/2023/incoming-payments-fraud-costs-companies-millions-every-year/#:~:text=Fraud%20is%20both%20costly%20
and,costs%20more%20than%20%2450%20million.

Beyond PCI DSS compliance2Turning gaps into
opportunities
Using the United States (U.S.) as a lens, we highlight compliancegaps and opportunities for the APAC region.
Around 17% of cross-border transactions8 within APAC originate
from the U.S. highlighting the global nature of digital commerce
and the importance of adhering to international security standards
like PCI DSS v4.0 to ensure safe transactions across borders.
Even though most organisations in the U.S. had over a year
to prepare for the PCI DSS v4.0 rollout, many boards are still
anxious, with new cyber disclosure rules from the U.S. Securities
and Exchange Commission requiring security leaders to reportcyber incidents to the SEC within four days of determining that anincident is material9.

Similar regulatory trends are rippling across APAC, highlighting
the importance and urgency of building a transparent organisationthat maintains sustainable control environments.
There is also the need for continual improvement to ensure
adequate, ongoing protection of payment card data.
Building this roadmap to achieve compliance—and thenmaintaining it—is painful for many U.S. and APAC customers.
Whether you’re at the stage of identifying PCI compliance gaps,
already aware of these gaps and looking for solutions, need athorough assessment of your current compliance status, or are
eager to enhance your payment security with innovative tools andprocesses, it’s time to take the next step forward.

8 https://www.enterprisetimes.co.uk/2021/10/28/digital-payments-in-europe-to-grow-by-70-says-new-ppro-research/
9 https://www.asisonline.org/security-management-magazine/latest-news/today-in-security/2023/july/SEC-Adopts-New-Cyber-Disclosure-Rules/
Beyond PCI DSS compliance3

Unscrambling
compliancecomplexity
The critical piece in this cube ofcomplexity is pre-assessments.
Verizon can help organisations balance
the areas in which they excel, are on par
or fall behind.
This forewarning provides theopportunity to prepare for the PCI
assessment thoroughly, using a practice
exam approach.
Many CEOs are surprised to learn how
poorly they perform in pre-assessments.
However, it can become the first step in atransformative security metamorphosis
and moving from a disjointed set of
activities to creating a formalised
program.

Principles driving
compliancesuccess
Amid the ever-changing and developing
landscape of the last two decades,
Verizon has shaped and continually
improved its approach to PCI complianceand predictable performance, which isunderpinned by four guiding principles:• Eliminate waste• Address low productivity• Prevent high cost
• Avoid stakeholder dissatisfaction
Many businesses treat their PCI security
checks as separate from their overall
governance plans. They need to see how
combining these streamlines activity andprevents the same tasks from being done
twice in different programs.

Beyond PCI DSS compliance4Annual introspection
By coordinating all the different PCI DSS rules and regulations
under one overarching governance strategy, we can strive toenhance PCI DSS compliance and effectively manage risks.
Companies should review their governance strategy every year,
checking the goals, requirements, and limits they might have. This
helps to keep things smooth and efficient.
A team of Qualified Security Assessors (QSAs) aims to help
enterprise and public sector agencies overcome these hurdles:

Beyond PCI DSS compliance• Maintaining organisational silos—hampering communication,
performance and sustainability• Focusing on technology, undervaluing processes andprocedures• Forgetting, underinvesting, rushing—inadequate organisational
competency development• Falling short on training and educational efforts
A unified approach can transform a project into a long-term
security program that modernises payment systems and aims toprovide resilient cyber protection from adversaries.

5Building compliant cybershields in APAC
Regular check-ups and a sharp, shared plan for safety can help steer
APAC companies clear of the cyber dangers spotlighted in the annual
Verizon Data Breach Investigations Report (DBIR).

Social engineering
In the APAC region, 93% of security breaches stem from tactics likesocial engineering, hacking into systems and exploiting vulnerabilities
in essential web applications10.
To counter these threats, PCI DSS v4.0 mandates stringent
rules11, such as fortifying network security, safeguarding payment
information, strictly regulating data access and conducting regularsecurity assessments.

Financial motives
The 2023 DBIR highlights how financial motives drive 61% of thesebreaches12, underscoring the imperative to secure payment data
against credit card fraud. PCI DSS addresses this by mandating
the encryption of payment data transmitted across the internet andensuring the secure storage of such data.

The human angle
Breaches often involve the theft of sensitive information, includinginternal company data, trade secrets and user credentials,
highlighting the necessity for PCI DSS’s requirement for dataencryption, secure data storage, and the implementation of robust
authentication mechanisms.
An overwhelming 92% of breaches within the 2024 DBIR data set
were orchestrated by external actors, emphasising the need forrobust external defences as outlined by PCI DSS.
However, internal actors are responsible for 9% of breaches in thesame data set, reinforcing PCI DSS’s emphasis on internal controls
like access restrictions and activity monitoring to mitigate insider
threats.
Adopting PCI DSS guidelines, such as implementing strong password
policies and assigning unique IDs to each user, helps companies toshield vital payment information more effectively from unauthorised
access, helping to ensure a more secure digital payment landscape.

10 https://www.verizon.com/business/resources/T42/reports/2023-data-breach-investigations-report-dbir.pdf
11 https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf
12 https://www.verizon.com/business/resources/T42/reports/2023-data-breach-investigations-report-dbir.pdf

Beyond PCI DSS compliance6

Industry compliance

Healthcare

While the DBIR includes data from around the world, including
sectors such as financial, insurance, retail, accommodation, andhospitality services, these findings offer valuable lessons for the
APAC region.

Overview: The healthcare sector remains a prime target forcyberattacks. The 2023 DBIR highlights 525 incidents, with
436 confirmed data breaches, primarily due to system intrusion,
basic web application attacks and miscellaneous errors13. These
threats underscore the urgent need for stronger cybersecurity inhealthcare.

Examining these industry data breach trends, APAC businesses
can anticipate similar trends and vulnerabilities within their own
markets.
It’s crucial, however, to adapt these insights with a keen
understanding of the unique regulatory, cultural and economic
landscapes across APAC countries.
This approach enables a holistic security vision that not
only meets global compliance standards like PCI DSS but
also addresses region-specific risks and opportunities for
improvement.

Key issue: Ransomware continues to plague this sector,
compounded by internal errors like misdelivery that put patient
data at risk.
PCI DSS v4.014 protections:• Requirement 5.1: Up-to-date anti-virus – Crucial for blocking
malware, often the initial stage of ransomware attacks.
• Requirement 9.4: Physical access controls – Limiting accessto sensitive areas helps prevent both external intrusion andaccidental data disclosure, a major internal threat.
While compliance doesn’t guarantee immunity, it provides a robust
defence framework for protecting healthcare information systems
and sensitive patient data.

13 https://www.verizon.com/business/resources/T73c/reports/2023-data-breach-investigations-report-dbir.pdf
14 https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf

Beyond PCI DSS compliance7Manufacturing
Overview: Manufacturing is a high-risk sector,
with 1,817 incidents and 262 confirmed breaches
reported in the 2023 DBIR15. System intrusions,social engineering and web application
vulnerabilities pose significant threats.
Key issue: External attackers, both financiallymotivated and seeking espionage opportunities,
exploit hacking, malware, and social engineering
techniques to target vulnerable manufacturingsystems.
PCI DSS v4.0 protections:• Requirement 4.1: Secure data transmission –Mitigates attack risks by encrypting sensitive data
during network transfers.
• Requirement 12.6: Security awarenessprogram – Helps employees to identify and avoid
social engineering tactics, a key attack vector.
Adherence isn’t a one-time fix. Evolving with PCI
DSS v4.0 builds resilience against the latest threats
and helps to safeguard manufacturing data.

Financial andinsurance
Overview: The 2023 DBIR highlights the sector’svulnerability, with 1,832 incidents and 480
confirmed data breaches, primarily due to web
application attacks16. This underscores the criticalneed for robust vulnerability management andpatching.
Key issue: Basic web application attacks continue
to be a major threat, leaving financial and insurance
data potentially exposed.
PCI DSS v4.0 protections:• Requirement 6.4: Install vendor-supplied
security patches – Mitigates attack risks byensuring all system components and softwareare up-to-date with security patches fromvendors.
Regular patching remains essential to address
evolving threats and to help safeguard sensitive
financial data.

15 https://www.verizon.com/business/resources/T73c/reports/2023-data-breach-investigations-report-dbir.pdf
16 https://www.verizon.com/business/resources/T73c/reports/2023-data-breach-investigations-report-dbir.pdf
Beyond PCI DSS compliance8Retail
Overview: Retailers remain vulnerable, with the 2023 DBIR
showcasing 406 incidents and 193 confirmed data breaches,largely driven by system intrusions, social engineering and web
application attacks17. This highlights the importance of secure data
storage and protection, especially for payment card information.
Key issue: Cybercriminals specifically target payment card data,
putting retail customers at risk.
PCI DSS v4.0 protections:• Requirement 3.2: Store only necessary authentication data
– Minimises the attack surface by mandating that only essential
authentication data is stored.
Regularly review and minimise data storage practices tosafeguard sensitive financial information.

Accommodation and foodservices
Overview: The sector reported 254 incidents with 68 confirmed
data breaches18. Highly dependent on payment transactions, it
faces a significant risk from RAM scraper malware used in 90%
of breaches stemming from system intrusion, web application
attacks, and social engineering.
Key issue: The prevalence of RAM scrapers targeting payment
card data highlights the need for advanced malware protection
strategies.
PCI DSS v4.0 protections:• Requirement 5.4: Protect systems from malicious software– Mandates the deployment and regular updates of antimalware solutions for effective detection and prevention of
RAM scraper attacks.
Regularly update and review anti-malware defences to ensure
effectiveness against evolving threats.

17 https://www.verizon.com/business/resources/T73c/reports/2023-data-breach-investigations-report-dbir.pdf
18 https://www.verizon.com/business/resources/T73c/reports/2023-data-breach-investigations-report-dbir.pdf
Beyond PCI DSS compliance9Other sectors
The insights above just scratch the surface.
The 2024 DBIR continues with the sectors we’ve discussed. It
also covers many more industries, including education services,mining, public administration and others.
We encourage readers to explore these sections to enrich theirknowledge and identify cross-industry patterns and solutions thatmight apply to their specific context.

Compliance across thecloudTransitioning to cloud services for processing, storing andtransmitting cardholder data introduces a new layer of complexity
in achieving PCI DSS compliance.
When sharing resources among multiple clients, it’s essential
to clearly define the responsibilities of both the cloud service
provider (CSP) and the client in protecting cardholder data.
PCI DSS Requirement 12.8, for example, mandates thatorganisations maintain a list of service providers with access to
cardholder data and a written agreement that acknowledges theproviders’ responsibility for securing that data.
Mapping the Cloud Controls Matrix to PCI DSS19 ensures thatcloud security measures align with payment data protection
standards, enhancing the security posture of cloud-based
payment systems and ensuring compliance with industry
regulations.
The Cloud Controls Matrix (CCM) is a cybersecurity framework
developed by the Cloud Security Alliance (CSA)20, of which
Verizon is a member. This membership aligns with our efforts
to promote security within cloud services and contribute todeveloping best practices for cloud security​​.
The Verizon approach to cloud security involves a detailed
mapping of CCM to PCI DSS, highlighting shared responsibilities
and ensuring a comprehensive protection strategy.
Verizon’s cloud services integrate PCI DSS requirements,
focusing on encryption, access control and continuous monitoring
to provide robust security for cardholder data in cloud platforms.

19 https://cloudsecurityalliance.org/blog/2023/09/19/strengthening-cloud-security-mapping-the-cloud-controls-matrix-ccm-4-0-to-pci-dss-4-0
20 https://www.verizon.com/business/resources/solutionsbriefs/2020/security-risk-assessment.pdf

Beyond PCI DSS compliance10Benchmarks that matter
We understand that aligning with industry standards is aregulatory requirement and a strategic necessity.
With a global presence, including operations in Australia andnine other security operations centres, Verizon manages over
500,000 security and network devices, providing substantial
insights into international and regional cybersecurity standards
and the information and services necessary to address potential
threats.
Verizon Governance, Risk & Compliance (GRC) advisory services
can help you measure and elevate your security program against
these essential benchmarks:• ISO27001/ISO27002: These standards form the foundationof a robust information security management system and arepivotal in enhancing PCI DSS compliance and helping to protect
cardholder data against potential breaches.
• National Institute of Standards and Technology
Frameworks: The comprehensive guidelines provided by
NIST Technology Cybersecurity Framework and Special
Publication 800-53 extend beyond compliance, focusing on
risk management and security controls to fortify your defences
against cyber threats, thereby supporting PCI DSS objectives.

Beyond PCI DSS compliance

Regional compliance in APAC:
The APAC region presents unique challenges, with local
regulations and standards introducing additional layers to PCI
DSS compliance:• The Australian Signals Directorate Essential 8:
Implementing these strategies bolsters your security posture,indirectly facilitating PCI DSS compliance by reinforcing
defences against prevalent cyber threats.
• Privacy Act 2018 Australia and New Zealand andInformation Security Registered Assessors Program
Certification: These frameworks signify a deep commitment todata protection, resonating with PCI DSS’s core principles andenhancing the security of sensitive information.
Backed by certifications like Certified Information Systems
Security Professional and Certified Information Security
Management Consultant, Verizon embodies a deep-rooted
understanding of these global and regional standards. This
expertise, combined with extensive experience conducting over
19,000 security assessments, uniquely positions Verizon to help
guide you through achieving and maintaining compliance.

11Compliance by design
PCI DSS v4.0 brings significant updates, including continuous
assessments and better validation methods.
It moves organisations from fixed rules to allowing flexible, goaloriented strategies in its 10th release.
The scale and pace of changing complaint regulations also put
overwhelming pressure on Chief Information Security Officers
and internal IT departments.
When we conducted a payment security report a few years
ago, we found that only 43% of companies met all compliancestandards21.
It’s understandably difficult not to take shortcuts or ignore
blind spots that can leave you vulnerable to compliance failure,especially as you stretch your perimeter to the cloud and IoT
environments.
Consequently, it no longer makes sense to keep every
cybersecurity aspect in-house. A partnered approach enables
CISOs to augment their core team with on-demand capabilities
that are usually quite hard to find and maintain.
CEOs and boards can have peace of mind knowing that Verizon
advisory service unearths overlooked areas while understanding
how different security measures and their settings interact.
This is a crucial goal of Verizon assessments for companiesof all sizes, including many Fortune 500 and multinationalorganisations.
Ultimately, security leaders should never forget that data security
and compliance success is achieved by design – not luck.

For more information on complying with PCI DSS v4.0,
contact your Verizon Account Representative
or call +61 2 9434 5000

21 https://www.verizon.com/business/reports/payment-security-report/2022/the-state-of-pci-dss-compliance/© 2024 Verizon. All rights reserved. The Verizon name and logo and all other names, logos and slogans identifying Verizon’s products and services are trademarks and service marks or registeredtrademarks and service marks of Verizon Trademark Services LLC or its affiliates in the United States and/or other countries. All other trademarks and service marks are the property of their respective
owners. 03/24
This handbook was created by InnovationAus.com, with information and input from Verizon.

Beyond PCI DSS compliance12