Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't stored at our servers.

Which PCI DSS SAQ applies to us? Which PCI DSS requirements should we conform to?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If your systems touch the cardholder data during transmission but you don't store any data, you will be an SAQ C.

For more guidance on determining you SAQ type, see the PCI DSS SAQ Instruction Guide v2.0 page 12, Selecting the SAQ and Attestation that Best Apply to Your Organization.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.