The Federal Trade Commission (FTC) issued orders to 9 companies at the beginning of this week, seeking information on how each company conducts Payment Card Industry Data Security Standards (PCI DSS) compliance assessments. PCI DSS audits are required by all major payment card issuing companies of ALL retailers and business that process over 1 million credit card transactions per year. PCI DSS protects consumers’ financial information by requiring minimum security measures when processing payment card data. The FTC is specifically seeking information about the way in which the assessors and companies interact, copies of a limited set of PCI DSS assessments themselves, and information on the other types of services provided by the companies (e.g. forensic audits). All information collected by the FTC will be used to put together a study on the current state of PCI DSS assessments. We will look for the study once it is released later in the year.