PCI adoption faces obstacles

"Most large companies at least have PCI initiatives in place if they're not already compliant, but because the TJX incident has not had the impact on sales that some have predicted, we are hearing about some CIOs who are pushing back and saying it's not as big of a deal," Pironti said. "Because the only real consequences are financial and, unlike some of the other regulations, no one going to jail for not following PCI, some companies aren't rushing to get prepared like they might have been in the past."

Michael Gavin, security strategist at Security Innovation, which provides risk assessment services to large businesses, said that some companies have hit a wall when it comes to certain aspects of PCI, such as in testing their business partners' compliance.

The mandate's requirement that companies ensure that whatever card processing providers they work with have their own houses in order has proven unwieldy, he said, and become an obstacle for some firms who felt that they were getting closer to achieving preparation for PCI audits.

"Because all the service providers haven't become compliant, companies were left wondering what they should do because the requirement should have worked top-down from the banks through the processors to the merchants, instead of the other way around," said Gavin. "There's been a wide range of quality in terms of how different banks worked with their partners to get the word out, so a lot of the preparedness depends on issues like that."

Gavin said that the banks at the top of the card-handling food chain should have been more aggressive about educating smaller partners about how they should deal with PCI DSS, with some doing a far better job than others.

Many companies are taking a "fail the first audit" approach to find out exactly what is expected of them in the future, he said, and the expert contends that it might be one of the most practical ways for smaller firms to approach the standard.

"It's very hard to say who is ready for an audit at all. Some companies have always been more conscious and concerned about third-party data, and those types of companies are clearly in a much better position than people who don't focus too much in security in general, especially smaller companies," Gavin said. "The truth is that a lot of merchants didn't know what they needed to do up until recently, so in the end, some might not be prepared as they should be."

Other industry watchers maintain that companies who have been serious about handling PCI DSS all along are for the most part prepared to be audited.

However, some companies may be missing the point of improving their overall security because they've been too busy attempting to meet specific requirements of the standard itself, they said.

"People who decided to be ready are going to be ready for the audits when they come, the problem is with people who are just scraping by with the standard but who are missing out on the idea behind the standard," said Rob Warmack, director of customer advocacy at TripWire, which markets IT configuration and change monitoring applications.

"When it comes to audit time, some of these people might find that they're going to be exposed to the assessors' interpretations of adequacy for all the controls," he said. "Others might squeak by the initial audits but find that this is an ongoing thing and realize that they missed an opportunity to go back and do things the right way the first time."