An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

2
votes
2answers
29 views

What constitutes submitting payment at a different address for PCI-DSS?

I am attempting to use TransArmor PCI Rapid Comply to verify compliance for my small business. At one point, I have two choices: 1) Customers submit payments at a different web address (i.e. ...
1
vote
2answers
49 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
4
votes
3answers
453 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To ...
0
votes
1answer
265 views

PCI Logging Data Elements for Network Devices, Databases and Wireless Networking

What is the best way to figure out what exactly needs to be logged for Network Devices, Databases and Wireless Networking Devices? I'm not an expert in this area but I need to figure out what data ...
3
votes
3answers
249 views

Third party analytics/tracking javascript tags and PCI DSS

Although variants of this question have been asked before, they seem to be about general risk, and I'm interested in the PCI DSS connotations. If an e-commerce site is looking for level 1 or level 2 ...
3
votes
1answer
98 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
3
votes
3answers
182 views

PCI scanning and penetration testing

We are moving a web app from an internal merchant hosted setup to a general service we can offer to other organisations. The actual credit card data handling is done by a level 1 PCI compliant third ...
3
votes
2answers
98 views

Why are there questions about “media” in a PCI-DSS SAQ A?

The PCI-DSS SAQ A is used in the case where all payments are outsourced to an external vendor (conditions apply). Despite that, section 9 of the questionnaire is about "media" (if they are physically ...
3
votes
1answer
183 views

Using Google Cloud Platform to store credit card data

I have made an iPhone app for users to book hotel rooms. A third party provides the service for booking the hotel rooms and charging the credit cards. At the moment, my app makes no attempt to save ...
4
votes
2answers
85 views

Steps to Become PCI Compliant?

I have a small business, and I'm in the process of building a new website. My card processing company says I need to be PCI compliant. I know I did this once before years ago and had the Compliance ...
5
votes
3answers
173 views

My client needs credit card details emailed to them, will an encrypted file work?

I have a new client who is a reseller for vacation packages. They have multiple wholesalers, and my client is instructed by the wholesalers to sign into their wholesale account, and enter their ...
2
votes
1answer
89 views

What is “cardholder data” in PCI-DSS SAQ A context?

The PCI-DSS SAQ-A questionnaire mentions on page iii that SAQ A merchants confirm that, for this payment channel: (...) Your company retains only paper reports or receipts with ...
2
votes
4answers
86 views

PCI-DSS 3 SAQ - uncertain of level

We are having a debate internally about which SAQ we need to fill in for PCI - our QSA questionnaire says D (and I tend to agree) but company director says SAQ C from reading the guidelines. The way ...
3
votes
3answers
268 views

Credit card processing in mobile app over Stripe - PCI DSS compiant?

after reading a lot of PCI DSS stuff I'm still not sure whether it would be ok for us to use the following process in our app: Get full credit card data from attached card reader Tokenize it using ...
0
votes
1answer
48 views

PCI SAQ C 1.2.1, 1.3.5 and remote server/software

I'm hoping someone here can help me. I'm attempting to get the small nonprofit I work at PCI compliant, as we have been paying an additional $20/month in noncompliance fees to our processor since we ...
0
votes
1answer
3k views

PCI DSS v3.1: clarification about usage of TLS v1.1

PCI DSS v3.1 recommends usage of TLS v1.1 or greater: https://www.pcisecuritystandards.org/documents/Migrating_from_SSL_Early_TLS_Information%20Supplement_v1.pdf … it is therefore strongly ...
2
votes
2answers
482 views

Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
3
votes
1answer
167 views

PCI Compliance SAQ-A-EP or SAQ D

Our eCommerce wesbite attracts less than 5000 CC transactions each year and we do no store any CC information in our backend or systems but transmit them to our third party provider. We also use a ...
0
votes
2answers
101 views

What is the PCI requirement for tracking software installation on workstations?

We have a task open right now to implement UAC and matching event log tracking for our devs installing software on their machines. I've been asked whether storing/parsing these logs centrally is a ...
0
votes
1answer
284 views

PCI requirement 8.3 - 2FA for all network access originating outside the network

Requirement 8.3: Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, ...
5
votes
3answers
824 views

PCI DSS - VPN network?

My network is segmented into internal (which holds private cardholder data), DMZ and VPN. There is a gateway in between which restricts access, for example: VPN: 10.0.0.0/24 DMZ: 10.1.0.0/24 INT: ...
5
votes
2answers
302 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
5
votes
1answer
164 views

PCI 3.1 - SAQ D - Supporting Servers

For the past year and a half now, I've been working as the sole individual at a small retail hardware store trying to attain proper (read: not checkbox) compliance, and I am beginning to enter the ...
3
votes
1answer
85 views

PCI DSS 3.0: 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities. However, what happens if ...
5
votes
1answer
172 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
2
votes
5answers
175 views

PCI Compliance and fines

Our organisation has validated compliance with PCI DSS. What are the consequences to us if we had been breached by a security incident related to credit card information, considering we have validated ...
4
votes
3answers
201 views

Tools to demonstrate NO storage of cardholder data

Our organization has been asked to comply with PCI DSS. As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication ...
1
vote
1answer
116 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
1
vote
1answer
53 views

Card Present PCI Requirements

We are using an IDTECH card reader for iPhone that is not encrypted, our application is web based and runs inside of an iOS app to pull the data off the card. We are then using a client side ...
1
vote
3answers
192 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
6
votes
5answers
167 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
0answers
34 views

PCI process, how to solve mambo vulnerability CVE 2006-0871 on debian 8?

I am involved in the process of becoming pci-dss compliant. I am really close to get it although I am having this vulnerability on the server when I am doing an external scan. Does someone know how to ...
2
votes
2answers
105 views

PCI DSS 3.0 and card swipe terminals for our merchants

We run an online software service that collects and transmits card transactions for small merchants. They use card swipe terminals connected to their business PCs that direct the traffic straight ...
1
vote
1answer
322 views

Is zinc.io PCI compliant (/does it need to be)?

zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being ...
1
vote
1answer
142 views

Confusion regarding PCI compliance in an office

We use myvirtualmerchant.com (previously Converge, owned by Elavon) to process payments in our doctor's office. Recently, they emailed us that we have to fulfill their partner company's (Trustwave ...
1
vote
1answer
399 views

Multiple Bank Accounts on one payment gateway or merchant account

I'm looking to use PCI compliant payment gateways such as Authorize.net or Spreedly.com in my website. However in my particular case (hotel, tour, events reservations), we will serve as an ...
0
votes
2answers
176 views

PCI-DSS, what is the best distro? [closed]

What is the best distro of Linux to get PCI-DSS compliant? I am using Debian 8 because I think Debian is one of the most stable versions, but it seems not to be enough, I am struggling with a lot of ...
0
votes
1answer
404 views

How can American Express Serve login be PCI-DSS compliant?

Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process. Here are the steps involved: ...
4
votes
1answer
565 views

Is Heroku PCI Compliant?

Obviously Heroku wants you to think they're PCI compliant by telling you "Heroku’s infrastructure provider is PCI Level 1 compliant" (AWS). https://www.heroku.com/policy/security But since Heroku ...
0
votes
1answer
240 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
3
votes
3answers
341 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...
0
votes
1answer
108 views

Distinguishing between tokens and actual PANs for tokens based on reversible cryptographic functions

I’m researching a possibility of implementing KEK and DEK servers compliant with PCI-DSS requirements. PCI Tokenization Guidelines states: “The tokenization solution should include a mechanism for ...
0
votes
1answer
189 views

PCI server room on premises: how to handle office visitors?

There is a server room which is part of PCI environment and located inside the office. Access to the server room itself is controlled according to PCI DSS Requirement 9: "Restrict physical access to ...
20
votes
3answers
25k views

PCI Compliance Scan Failing for supporting TLS 1.0, but removing support breaks < IE 10

My company is receiving this message causing us to fail our TrustKeeper PCI compliance scan: Note to scan customer: This vulnerability is not recognized in the National Vulnerability Database. TLS ...
1
vote
0answers
34 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [closed]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
1
vote
0answers
48 views

Internal Vulnerability scans - defining the applicability

If a service provider has a network with thin clients, and they use a citrix portal to access a PCI complaint service provider's cardholder data environment. If the environment is very similar to tho ...
3
votes
1answer
148 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
3
votes
1answer
94 views

How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW)

Thanks in advance for your advice We have to implement VPN connection for nearly 7 countries Option 1 : As we have private MPLS link to all 7 countries. It is been outsourced Third party. They ...
3
votes
1answer
174 views

How can a very small company handle PCI-DSS requirement 6.4.2?

PCI-DSS 3 requirement 6.4.2 calls for Separation of duties between development/test and production environments. Based on the guidance text and this, answer to another question, it appears ...
4
votes
1answer
457 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...