Brian Jones Harbortouch

R oss Federgreen, Chief Executive Officer and founder of payment and data privacy consultancy CSR Professional Services Inc., frequently finds himself correcting misconceptions about data security. Take the Payment Card Industry Data Security Standard (PCI DSS): "PCI is a misguided concept these days, " he said, noting that despite years of outreach and education, many small merchants, whether they realize it or not, are not compliant.

"They check off all the self-certifying boxes, and that's a mistake, " he said. "It has absolutely nothing to do with the realities of the world and the big players who spend tens of millions of dollars on very sophisticated systems that still get hacked all the time."

Federgreen also noted that only 4 to 7 percent of breaches are bankcard related; over 90 percent target other types of personally identifiable information (PII), such as birth dates and Social Security, driver's license, and automated clearing house routing numbers.

Payments at the core

Federgreen served as an adviser to the United States Senate, the U.S. Agency for International Development and numerous multinational corporations. When he founded Jensen Beach, Fla.-based CSR in 1999, he was drawn to payments because "payments are at the core of what is keeping people in business, " he said. CSR's initial goal ‒ to offer compliance remedies for regulatory headaches ‒ remains relevant today.

CSR offers a range of data privacy and security tools and services for businesses, organizations and even schools. These include the patented CSR Breach Reporting Service, which facilitates timely, accurate PII data breach reporting and consumer notifications; the patent-pending CSR Readiness Suite, a data life cycle management program that provides online risk evaluation, remediation and employee training material related to PII; and Stand-In Privacy Officer (SIPO), which provides comprehensive consulting for midsize and large companies.