3

Setting up a new company with ecommerce app, and looking at PCI compliance.

What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire?

The context in which we will be processing payments will be in one of the following scenarios:

Option 1 PayPal pro - credit card information is processed on our domain and website, but is not stored in our database - it is simply transmitted to PayPal.

Option 2 SagePay server & inIframe - credit card information is entered on our website, but never hits our system because the SagePay hosted Iframe sends the data directly to SagePay.

Any advice appreciated. I have read PCI documentation, but still unsure about the process.

Improve this question

1 Answer 1

Reset to default
5

No, the point of the self-questionairre is that you don't need a QSA.
On the other hand, you might want some assistance or guidance, to verify that you complete it correctly - you still may be subject to an audit, and you'd be worse off after filling it out incorrectly.

Also, you'll still need an ASV (authorized scanning vendor) to run your quarterly scans.

Improve this answer
3
  • 1
    +1 for having someone (e.g. knowledgeable consultant) sit with you the first time you do this
    – voretaq7
    Commented Apr 22, 2011 at 16:23
  • +1, thanks that clarifies that. I wasn't aware that the scanning vendor can be a separate entity.
    – gbro3n
    Commented Apr 26, 2011 at 14:10
  • @BombDefused, ASV usually is seperate from QSA, though they don't have to be. (Usually ASVs have a cheaper per-hour rate than QSAs too, so consider shopping around.) Another point you should pay attention to: network ASV and application ASV are not always the same. These are two seperate requirements in the PCI, and some ASVs do one, but not the other.
    – AviD ♦
    Commented Apr 26, 2011 at 14:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .