New answers tagged

3

The merchant or charity who accepts only PayPal, and uses a mechanism that redirects the customer/donor to PayPal's site does not handle the credit card at all. PayPal does that, takes a fee for the service, and remits the rest to the merchant. So, PayPal has to comply with PCI-DSS, but the merchant who uses only PayPal and does so with redirection to ...


2

PCI applies to ANY organization or merchant, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. Said another way, if any customer of that organization ever pays the merchant directly using a credit card or debit card, then the PCI DSS requirements apply. https://www.pcicomplianceguide.org/pci-faqs-2/#2 But: ...


5

The short answer is yes, but it's more difficult. The main principle of using VLANs to segregate the PCI DSS environments is reducing scope for assessment and maintenance. If you reduce the scope, then only the servers which need to be compliant are assessed. If you don't segregate, then the rest of your network (and all the users of those devices) come ...


0

Short version: PCI documents leave room to support either stance Your QSA's approval or disapproval trumps anything you think the documents say (as always!) In practice, I have seen QSAs accept limited-scope pentests when "significant changes" were limited in scope to the environment Long version: On the face of it, the wording of the DSS seems ...


0

I was thinking was covered by PCI DSS, but I cannot find in explicitly covered section 3 of PCI DSS 3.1. Did I miss this or this more of a processor/gateway requirement. In either case, it is still a good idea against test accounts. We have customers that have the same need. One option is to store up some real transaction if using save cards and then run ...


1

You could not let one employee see the all the data, e.g. have one employee enter the cc number and name and have another employee enter the cvv and expiration date. This way no employee ever gets to see all the cc data and cannot copy or memorize it. This would mean that you need 2 images of the application form, one where the name and number are blacked ...


2

(Some assumptions here for the lack of references) According to this Visa page, issuing and acquiring banks are subject to the PCI DSS: All entities that store, process, or/and transmit cardholder data, such as merchants, service providers (e.g. payment gateways, IPSP, processors), issuers and acquirers, must comply with the PCI DSS As such, they ...


2

Once an employee has access to this data, you cannot actually control what they do with it. There are useful restrictions, such as: disallow phones or camera devices disallow taking papers home strongly restrict what their computer can access As well as wider controls such as: employee vetting contracts that include major disciplinary repercussions ...


2

You cannot store sensitive credit card data "after authorization" (as per PCI DSS requirements, point 3.2) so you must make sure (and provide evidence) that every copy (the original printed copy captured at the scanner and the digital one sent to the application at both ends) are securely destroyed inmediately after. It is not a problem itself to send the ...


3

Regardless of the format it is in, storing full PAN data increases security risk and, consequently, it’s scope of PCI compliance. You would need to make sure that at every step, these compliance requirements are met: One-way hashes based on strong cryptography Truncation Strong cryptography Index tokens and pads If you storing PAN data as indicated, ...



Top 50 recent answers are included