Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Setting up a new company with ecommerce app, and looking at PCI compliance.

What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire?

The context in which we will be processing payments will be in one of the following scenarios:

Option 1 PayPal pro - credit card information is processed on our domain and website, but is not stored in our database - it is simply transmitted to PayPal.

Option 2 SagePay server & inIframe - credit card information is entered on our website, but never hits our system because the SagePay hosted Iframe sends the data directly to SagePay.

Any advice appreciated. I have read PCI documentation, but still unsure about the process.

share|improve this question

migrated from Apr 20 '11 at 18:16

This question came from our site for system and network administrators.

up vote 5 down vote accepted

No, the point of the self-questionairre is that you don't need a QSA.
On the other hand, you might want some assistance or guidance, to verify that you complete it correctly - you still may be subject to an audit, and you'd be worse off after filling it out incorrectly.

Also, you'll still need an ASV (authorized scanning vendor) to run your quarterly scans.

share|improve this answer
+1 for having someone (e.g. knowledgeable consultant) sit with you the first time you do this – voretaq7 Apr 22 '11 at 16:23
+1, thanks that clarifies that. I wasn't aware that the scanning vendor can be a separate entity. – gb2d Apr 26 '11 at 14:10
@BombDefused, ASV usually is seperate from QSA, though they don't have to be. (Usually ASVs have a cheaper per-hour rate than QSAs too, so consider shopping around.) Another point you should pay attention to: network ASV and application ASV are not always the same. These are two seperate requirements in the PCI, and some ASVs do one, but not the other. – AviD Apr 26 '11 at 14:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.