We're working really hard to achieve PCI compliance for a project and will likely be spending hundreds of dollars each month, but I was wondering what if, god forbid, something unlikely happens and there is a breach somehow, do we still pay for the "inquiries" and the exposed card holder data although we were PCI compliant?
I'm just considering the worst case scenario, because if companies like Sony can get hacked then we're a tiny startup afterall.
PCI compliance is not insurance.
It is not a real measure of protection.
I sum up the value of of PCI compliance in my well-known eponymous law, AviD's Law of Compliance:
PCI compliance reduces the risk of the penalties of non-compliance.
In other words, much like how paying taxes is a requirement but does not necessarily entitle you to any specific government benefit - you have to be compliant. And if you're not, you will have to pay a fine. But this does not necessarily help with preventing breaches or responding to them...
As I answered in Vulnerability scanning applicability for PCI DSS, compliance is not about security.
As the other answers here mentioned, you need to implement security controls and secure features aside from the compliance. If you get breached, you still have fallout from that.
However, being compliant in the event of a breach does mean that you won't be getting a non-compliance fine. (See AviD's law above...) You'll need to pay any other costs, such as damages and repair costs, but at least there won't be a fine (well, at least not from PCI - other laws and regulations may apply).
Be aware that getting QSA sign off for compliance doesn't necessarily mean you comply with PCI.
While you need to show PCI compliance, you will be better off focusing on getting your controls right, which will both protect you and put you in a good position to pass PCI.
And yes, you will still have all the expected costs if you do get hacked.
Yes, you do pay for those inquiries even if you were PCI Compliant. But being PCI compliant also means that you are much, much less likely to experience such a breach.
Consider stripe - then you have no credit card data on file to hack and you only have to worry about the sort of breach where a hacker gets your shopper emails and emails everyone that their card data has been compromised (when in fact it has not).
Even that will get you a fine, because you allowed the email list to be hacked and earned bad publicity for the entire PCI industry.
Your contention that getting fined 'even if I am PCI comliant' isn't fair - makes it sound like you have no real intention to engage with the real idea being discussed here - taking responsibility for making sure that card holder data is safe.
