Information Security Policy in the U.S. Retail Payments Industry

The United States retail payments industry is in the middle of a transition in regards to information security. A substantial number of data breaches have occurred over the last five years, despite substantial compliance with the industry standard, the Payment Card Industry Data Security Standard. There will need to be a move to a higher level of security, and the major challenge is institutional. How can the industry organize itself to move collectively toward this goal? Without recommending any particular technical solution, this paper proposes one way to do meet this institutional challenge. Drawing on the experience of Europe and the United Kingdom in moving to a chip and PIN environment, I recommend a public-private partnership where industry, government and civil society jointly work through the technical, economic and public policy issues that need to be solved if we are to have improved information security in the industry.