BASKING RIDGE, N.J. -- Nearly 80 percent of all businesses fail their interim PCI compliance assessment leaving them vulnerable to cyberattacks, according to Verizon’s 2015 PCI Compliance Report, released today (March 12). With more than two-thirds of all purchases made with payment cards and $20 trillion in credit card transactions expected for 2015, security has become a top priority for organizations that accept credit cards.

In its fourth annual installment, Verizon’s 2015 report examines the state of Payment Card Industry Data Security Standard (PCI DSS) compliance and its correlation to data breaches among global organizations in the financial services, retail, and travel and hospitality industries, among other sectors.

Verizon’s cybersecurity research has consistently found that since 2009 organizations suffering a data breach showed lower than normal compliance with a number of PCI DSS controls.

By reducing the likelihood of being breached, companies can better manage their brand, ensure consumer trust and potentially avoid hefty fees. In fact, 69 percent of all consumers are less inclined to do business with a breached organization.

“Today’s cybersecurity landscape is constantly changing,” said Rodolphe Simonetti, managing director, professional services for Verizon Enterprise Solutions. “Compliance at a point in time isn’t sufficient to protect data. Putting the focus on making compliance sustainable is key. It must be a part of day-to-day activities within an organization’s greater security strategy.”

Key 2015 PCI Findings Overview
This year’s findings indicate that only 28 percent of companies are still fully PCI DSS-compliant less than a year after being validated. While annual compliance and ongoing control standard maintenance remains low, there is a bright spot in the 2015 report. Twice as many companies were validated as compliant during their interim compliance review in 2014 as compared with 2013. According to Simonetti, “The three key areas where organizations fall out of compliance are regularly testing security systems, maintaining secure systems and protecting stored data. Of all the data breaches studied, Verizon’s findings clearly show that not a single company was fully PCI DSS compliant at the time of the breach.” Additional key findings from the report include:

Verizon Communications Inc. (NYSE: VZ)