There are a lot of questions on storing credit card information, and of how PCI SSC/PA-DSS regulations apply to such activities and systems. I have read a lot of these, but my question relates to a different question that may or may not have anything to do with PCI compliance.
My question is specifically, what are the implications of storing sort-codes and account numbers online, considering we are not taking any kind of payment. So, nothing to do with using the information to make payments through the system, but using the information to enable other users who have access to the system to make payments.
I have taken a look at this question: Is PCI DSS applicable to other solutions than those dealing with payment cards?, but I really need to know the regulations and what is mandatory.
I understand that if we did have payment provision on the website we are developing, then the storage of account numbers would affect the level of PCI compliance we would need to adhere to.
Currently we are adhering to what would be considered security 'best practices', so using SSL, encrypting information in the db, dedicated server with hardware firewall etc., but these 'best practices' are from an internal point of view of a development team. I know the software in PCI compliance is only one part of overall security regulations. Outside of PCI compliance, is there, for example, a definitive set of rules for storing sensitive information? Are we for example obligated to adhere to ISO 27001 standards? Who defines what information is considered 'sensitive'.
The general consensus regarding PCI compliance and the handling of credit cards, is if you need to ask then you shouldn't be doing it. I'm not necessarily asking whether or how we can do it or not, but whether anyone has experience of this, and whether we need to engage a 3rd party consultant who specialises in such areas.