Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

Low down: This client does zero with credit card data (no processing, no passing of it, nothing), but they do have a device often placed on the same network segment of a POS (Point of sale) system.

The key is their clients are expecting them to follow PCI security requirements and to produce an attestation. Given this, which PCI SAQ is appropriate to use?

PCI document library: https://www.pcisecuritystandards.org/security_standards/documents.php

share|improve this question

2 Answers

up vote 2 down vote accepted

SAQ A is the most applicable, which is defined as " Card-not-present Merchants, All Cardholder Data Functions Outsource".

In all honesty, they can sign their name to any of the SAQs because without storing, processing, or transmitting cardholder data, they are meeting every point on the DSS. If I were them I would sign an SAQ D (which is the full DSS) because it looks better.

A better approach for them would be to show how the device that they place in the Cardholder Data Environment (CDE) is compliant with the PCI DSS.

share|improve this answer
up vote 1 down vote

I'm a bit puzzled - if they are not dealing with CC data in any way, then there is no PCI requirement for them. The initial response should be to ask what attestation their client wants and then work to that.

In fact, in going through the details of the PCI docs (which I havden't done in a few months, but was bored this evening) there is nothing I can hang on to point them at. Seriously, the key response to the clients should be:

PCI DSS has nothing for us, but what standards do you want us to meet?

share|improve this answer
actually this happens more than you think. customers under PCI regulation frequently want their business partners to be PCI compliant regardless of the requirement for them to be so or not. my client, in particular, is not allowed to respond to valuable RFPs without providing an attestation; also existing clients are more receptive to their products being deployed into their PCI compliant environments if they continue to show PCI compliance via attestation. short answer: provide PCI attestation or no sale. – Tate Hansen Jan 21 '11 at 4:42
@Tate, there is no such thing as "PCI attestation". Either you have a QSA certify you as compliant, or not. You can fill out a SAQ if you want, but so what? That said, if they want to claim "compliance", they'd be better off looking at PA-DSS than the standard PCI. Of course, the problem will eventually come back to the fact that the client doesnt want them to break the client's PCI compliance... – AviD♦ Jan 23 '11 at 7:17
@Avid what? "Attest is a legal term that refers to the act of a person swearing to or affirming the truth of something". My client currently has an attestation of PCI compliance. It’s about to expire; hence this question. – Tate Hansen Jan 23 '11 at 18:58
@Tate and @AviD - think you both mean the same thing but wording may be different in different countries. The QSA confirming your PCI compliance is often called an attestation. – Rory Alsop♦ Jan 23 '11 at 19:00
@Rory - thanks, yeah I guess its a wording issue. Never heard that called an attestation (even though I've done some work in the UK around PCI... :$). Sorry @Tate... But again, why would a QSA certify/attest on a product that doesnt use CHD? – AviD♦ Jan 23 '11 at 19:07
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.