Last month Visa made changes to the compliance requirements of "Level 4" merchants. Level 4 merchants typically process between one million and six million credit card transactions annually and since then they are now required to submit to quarterly network vulnerability scans, as well as filling out a 75-question self assessment form annually.

Although Visa Australia has confirmed the changes currently apply only to the US, the local security industry expects the changes to eventually reach Australian shores.

"At this point no other Visa region has aligned with them," a local Visa spokesperson said.

Drazen Drazic, general manager of security firm Security-Assessment.com, said organizations which are classified at the higher levels will need to start thinking seriously about the mandate and the ongoing costs.

He said penetration test costs vary depending on each organization, but can start at A$17,000 (US$13,000) for review of a small site.