Beyond the Firewall: A Critical Analysis of Payment Card Industry Data Security Standard
Faith Tinonetsana · Veena Rawjee ORCID ↗
International Journal of Business Ecosystem & Strategy · 2026 · Vol. 7 / Issue 6 · 218-225
Publication metrics
External links open provider records or DOI searches. Provider counts are not combined. Mendeley readership measures saves, not citations.
Dimensions
Live provider badge. If unavailable, use the Dimensions link above.
Observed 21 Oct 2026, 00:14 UTC
Observed 21 Oct 2026 00:14 UTC
OpenAlex and Mendeley observations refresh on article visits, at most once per 24 hours. Unavailable data is not zero. Google Scholar opens a DOI search.
Citations received by this article, grouped by the year of the citing work. Crossref and OpenAlex lifetime totals remain separate in Publication metrics.
2017–2026 Annual history last updated:
Citations received
OpenAlex · year of the citing work
Hover over a year or focus the chart and use arrow keys to inspect values.
2017–2026 annual-history window. 2026 is year to date. Unknown years have gaps.
View data & coverage
2026 is incomplete. Within a successfully fetched ten-year window, omitted years mean zero. Years beyond a saved observation’s window remain unknown (—). Older citations are excluded, so this chart’s sum may differ from the OpenAlex lifetime total. The date above belongs to this annual history; an unsuccessful refresh keeps the previous observation.
Abstract
The Payment Card Industry Data Security Standard (PCI DSS) was introduced in 2004. It aimto strengthen payment card security and reduce fraud through a set of global requirements for entities that process, store, or transmit cardholder data. Despite widespread adoption, payment card data breaches remain common, raising questions about the effectiveness of PCI DSS as a comprehensive security solution. Institutional theory is used to explain how organisations may adopt PCI DSS for symbolic legitimacy rather than substantive security, leading to a disconnect between formal compliance and operational resilience. By reviewing academic literature, industry reports and case studies, including regional perspectives from South Africa and Botswana, this paper examines the challenges of PCI DSS. Findings show that big breaches often happen when companies fail to follow the PCI DSS. The study further shows that, in some cases, firms that pass compliance checks may still be at risk since audits may not capture real-world weaknesses in their everyday security practices. Despite its importance, PCI DSS faces notable limitations. Compliance can be resource-intensive, requiring significant financial, human and technical investment, which poses challenges mostly for smaller organisations. Further, the standard often lags behind evolving cyber threats, creating a gap between formal compliance and actual security effectiveness. Based on the findings, this paper suggests that PCI DSS should not be seen as a complete solution; companies require additional compliance to guard their safety. The study recommends the strengthening of the PCI DSS to incorporate emerging technologies, shifting focus from compliance to resilience and fostering a security culture supported by adaptive monitoring and regional enforcement.
Authors & affiliations
Faith Tinonetsana
Durban University of Technology
Veena Rawjee
Durban University of Technology
Deposited references
Supplied references, not a list of publications citing this article.
No reference list supplied.