Credit card merchants see the approaching Payment Card Industry Data Security Standard as an easily attainable goal, but IT security experts think otherwise.

The Payment Card Industry (PCI) Data Security Standard is a list of 12 items that retailers, online merchants, data processors and any business that handles credit card information must comply with by June 2005.

The standards push has a greater impact on medium-sized credit retailers rather than larger financial firms, according to Bruce Cox, American Express regional head of security and investigation.

This is because the standards are leveraging off best practice already used by international credit traders and Australian banks, which claim they are well ahead of the deadline.

For example, Cox said when it comes to securing databases Australia is ahead of the pack.

"If a criminal hacks into a company file server we are so well set up here that it has next to no impact on us at all, but this isn't the case in the US," he said.

"You read a lot about Australia being the world leader in adopting technologies like encryption and we really do have it well covered," Cox said, adding that the industry welcomed auditable controls such as the PCI security standard.

Merchants don't want to be compromised he said. He described the standard as a set of new brakes that will give business better response times.

"All these initiatives being pushed by Visa and others are running on the coat-tails of what we [American Express] have been doing for some time," Cox added.

The security standards mandate compliance for merchants that store or transmit credit card information; they include a specific set of information security requirements that companies must adhere to or risk facing heavy fines. Merchants that don't comply with the standards may also barred from processing credit card transactions in the future.

The requirements include annual security self-assessments and for online members quarterly security scans are mandatory.

This applies to merchants and service providers that process more than $125,000 gross per month in credit card transactions.

Not surprisingly, introduction of the standard has been good news for penetration testers.

One testing firm Security Assessment.com claims the standards have come out of the blue for some merchants and not everyone is as well prepared as American Express.

The company's managing director Drazen Drazic said some merchants are concerned they will not be able to meet the compliance deadline.

"While the actual standards are long overdue, they are quite detailed and will involve a good deal of financial investment which will threaten some merchants."