Schneier on Security

Clive Robinson • October 30, 2025 2:58 AM

@DDNSA, Doug Deden,

“are there PCI DSS Equivalents outside of U.S. Jurisdictions, and how stringent are they?”

The answer is it’s complicated for two basic “base” reasons,

1, Contrary to what many think, legislation and regulation do not cross “sovereign” jurisdictional boundries.

2, In any movement of “information” it’s seen as an “object” somewhat equivalent to a physical object in transit. Thus there are three things to consider, where the movement starts, where the movement ends, and surprise suprise all points the information crosses in between.

With actual physical objects there is national legislation covering the end points and International treaties. International treaties for information objects are really few and quite murky. Much of it is done through the United Nations via the ITU.

So the first question you have to ask is,

“What is the PCI DSS actually, and what does it cover?”

The reality is it’s “a standard” from a commercial organisation. As such it has no legal status, except

1, By agreed contract.
2, Where a jurisdiction directly references it in “primary legislation”.

These two points show there is a very real legal issue.

Ask yourself a question,

“What happens when the commercial entity ‘changes the standard’?”

It’s why it’s usual to not quote a commercial standard title or section numbers but “directly quote” the passages.

There are however non commercial standards issued by accredited “Standards Bodies” they have legal obligations that unwind some of the issues, and generally they try not to create any.

I used to have involvement with the “British Standards Institute”(BSI) back when it was in Chiswick / Kew SW London. And most standards even though technical in nature were not written by engineers but lawyers with long experience in “the legalise required”. It used to be the same in the EU, except for the additional process of translating into the required languages. But it might have changed in the couple of decades or so since I last had to have direct dealings with them.

Commercial Standards are very rarely written in formal legalise thus incorporating them in primary legislation really is asking for trouble. Which is probably why the US Federal Government has not put PCI DSS in their legislation, nor have most US states (the last time I checked)[1].

OK having “salted the earth” the PCI DSS covers information security in the three states of information,

1, Communications
2, Storage
3, Processing

And enforcement is for the latter two by contract not legislation

Because,

“All organizations that process or transfer cardholder data need to be compliant with PCI DSS. But this isn’t enshrined in national legislation. Instead, compliance is mandated by the PCI Security Standards Council, (a group of the five largest card issuers[3]). Companies can face fines from these card issuers if they do not meet the correct PCI DSS compliance level.”

If the organisations don’t pay when fined, they will nolonger be allowed to be part of the PCI payments system. Thus in many cases they would go out of business in very short order.

So there is a significant level of coercion, but only for contract tied entities that process card data.

But In Europe and UK data security of personal information is “back stopped” by primary legislation. That is if a data breach does happen and the entity does not have suitably adequate data protection policies. They could potentially vface huge fines from government regulatory bodies. As these fines are based on “global turnover”, the penalties of a data breach of consequence can be quite significant.

But “communications” is different.
Because the other two are in effect covered by “contract at a known location” owned by a “signed up entity” both end points are in effect covered. Which leaves open the question of the journey.

As communications is in most cases actually done, not by a “signed up entity” but a notionally public entity with “common carrier” status. This means that the journey is not enforceable by contract and might get routed any where in the world even if only intended to cross town.

It’s a distinction that is lost on many. But it’s why you see statements such as,

“PCI DSS sets 12 requirements for the secure processing and storage of cardholder data.”

Note that “communications” is omitted…

But of more concern is the changes from v3.2.1 to v4.0 the older version was prescriptive where as the latter is effectively advisory.

So you see,

“Protect cardholder data with strong cryptography during transmission over open, public networks.”

So you have to dig down, but you might also miss,

“Restrict physical access to cardholder data.”

And it’s relationship to “strong cryptgraphy”.

In essence you need to think in multiple levels of encryption. That is encryption of information, and further Super encryption of communications channels.

There is a lot of nuance in v4.0 which is actually a bad thing in some respects.

But the point is,

1, An information object needs to be encrypted when stored and communicated.

2, Communications needs it’s own additional encryption from channel end to end.

And they need to be as segregated and independent as possible.

There are all sorts of other requirements when you get into the 300 or so sub points that are under the 12 major points

I hope that covers what your question could cover.

Personally I’m glad I no longer need to get my hands dirty with PCI DSS.

[1] Fun fact you are supposed to know all laws and regulations in the UK, it’s an impossibility even for Judges. But Courts stick to the fantasy for various reasons.

However formally legislation has to be published without impediment…

Which raises the thorny question of what an “impediment” actually is. I’ve been involved with a challenge that basically said “Standards Bodies do not Publish they sell for more than cost, thus profit”[2]. Which makes it an impediment as it is no longer “a social good” there was lots of twisting and turning and,

“It got kicked into the long grass”

So never got to an answer, so the Status Quo prevailed.

[2] The last time I had reason to check the prices, there was a vast price difference between “The London Gazette” and the price of all the Standards issued in a year by a factor of well over a hundred. In between but much closer to the equivalent daily price of the gazette was legislation in printed form from “Her Majesty’s Stationary Office”(HMSO). But this was before “political idiocy” ment that for “cost savings” the HMSO ceased to exist and became a “commercial entity” called TSO. And it was required to in effect “make a significant profit”. Thus “Law became a “Commercial Concern” not “A public Good”. A quick check shows that the London Gazette is now only available on annual subscription and costs over $5000 or ~$20/day. So nolonger in any way “Published Publicly” or available to “The man on the Clapham Omnibus”.

[3] The list of five “” is ,

American Express,
Discover Financial Services,
JCB International,
MasterCard Worldwide,
Visa Inc.