Call it a loophole, but if you're outsourcing your credit card processing technologies, then you're off the PCI hook. As IT budgets get cut, or remain static as the economy spirals downward, fewer businesses will have the capabilities to process the credit-card payments of their customers.

In light of enormous changes to become PCI-compliant, third- and fourth-tier businesses and other businesses with limited internal resources will increasingly rely on outsourced companies to handle their payments.

"Some of them decided to change the way they take payments," said Sumedh Thakar, PCI solutions manager for Qualys. "Budgets are tight. To do compliance on an ongoing basis, you have to have a staff and a team."