The Payment Card Industry (PCI) Data Security Standard (DSS) has been the primary regulation to which industry stakeholders that process payments must adhere. PCI DSS is published by the PCI Security Standards Council (https://www.pcisecuritystandards.org/), an organization focused on protecting financial accounts and transactional data. 

In order to understand the impact of the IoT on payment processors' abilities to safeguard information, let's first examine the 12 high-level PCI DSS requirements. The following list identifies the 12 requirements, as per the latest standard (see https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf):

• Install and maintain a firewall configuration to protect cardholder data
• Do not use vendor-supplied defaults for system passwords and other security parameters
• Protect stored cardholder data
• Encrypt transmission of cardholder data across open, public networks
• Protect all systems against malware and regularly update antivirus or programs
• Develop and maintain secure systems and applications
• Restrict cardholder access to cardholder data by business need-to-know
• Identify and authenticate access to system components
• Restrict physical access to cardholder data
• Track and monitor all access to network resources and cardholder data
• Regularly test security systems and processes
• Maintain a policy that addresses information security for all personnel

If we examine the retail industry as an exemplar for discussing possible IoT impacts to the PCI, we have to consider the types of changes the IoT may bring about in the retail world. We can then determine whether PCI DSS applies to new IoT system implementations in a retail environment, and whether other regulations apply to IoT implementations in retail establishments.

There will be many types of IoT device implementations and system deployments in the retail industry. Some of these include the following:

• Mass implementation of RFID tagging for inventory control
• Consumer ordering technologies that support automated delivery of products
• Automated checkouts
• Smart fitting rooms
• Proximity advertising
• Smart vending machines

Examining such use cases, we can see that many of them (for example, automated checkouts and smart vending machines) include some aspect of financial payment. In these cases, the supporting IoT systems must adhere to existing PCI DSS requirements.