I'm concerned about my client being Payment Card Industry (PCI) compliant. Recently, I was tasked with rebuilding a payment processing component. As part of my analysis, I asked the project stakeholder if they wanted to be PCI compliant. The short answer from his is that "Becoming PCI compliance isnt in scope for this new component rebuild" As an engineer, Do I have any option to avoid building something that is not PCI compliant? I.E. Storing a customers credit card details into a system of records is just plain bad.
p.s. I would like to keep my client. Obviously I could just terminate my relationship with the client, but I'm exploring other options than this to start. I am proposing to my client that both achieving PCI compliance as well as rebuilding the components to be more streamlines could be achieved together.
At the end of the day, I want my clients business to have LESS RISK.