What? Mandate a bunch of paper-thin worthless rules that tie up security & engineering teams and don’t actually add measurable security improvements?
I’d be very interested in seeing the data that shows PCI-DSS has had any impact. I spent a previous life breaking into PCI compliant companies, and it didn’t offer the tiniest speed bump.
This is a horrible recommendation.
Just like the failures of traditional Enterprise Architecture, the Prescriptivist, universal top down method eats lots of resources without delivering much value to the company.
While governance and policy are important, most are written to CYA more than to solve the initial problems.
As an example, as a consultant I once found a serious vulnerability with a serialization library on a very large companies stack.
Because it wasn't web facing, it couldn't be prioritized as policy didn't allow increasing its weight.
They were compromised a few quarters later... but it was their policy that they wrote that caused that.
Almost universally, restrictions and barriers have almost nothing to do with PCI requirements, but due to how the company implemented it.
A lot of that is due to the consulting and certification industrial complex and the focus on productized offerings. Just as chatGPT is intentionally verbose because it appears more authoritative, companies adopt governance that is way more detailed than appropriate.
Obviously any compliance will have some detailed and firm requirements, but the core concepts are replaced with blindly implemented checklists when values and principles are what should drive most decisions in specific systems.
The requirements to be PCI compliant often follow that concept far more closely than what companies actually adopt.
PCI DSS isn't that far off from generic best practices, optimization for superficial Self-assessment questionnaires and audits that we know don't catch much over those best practices is the problem.