We are moving a web app from an internal merchant hosted setup to a general service we can offer to other organisations. The actual credit card data handling is done by a level 1 PCI compliant third party via an iFrame, so we never see any of the data. Even so the SAQ is jumping from A to D according to the discussions we've had with a QSA.
I'd like to get an understanding of scanning and penetration testing from those that have been through it before. That seems to be the largest external cost for us and may affect our architecture.
The vulnerability scanning seems to be an automated service which looks for major issues. The costs appear to start from a few hundred dollars a year.
Penetration scanning seems to be a manual process where someone actively looks for holes in the security. The costs appear to start from 3k-4k a year. The scanning is broken into external and internal scanning, I'm not clear on where the border is between internal and external. For example, does external include a logged in user? It also seems possible to do the internal scanning yourself if you have done the correct training.
We had planned to have a setup (webserver etc) per client so that all their data etc would be completely siloed and allow customisation, each client would have their own subdomain. I'm wondering now if that would require a penetration test per setup?
From the examples in the SAQ around penetration testing it seems that a new one must be done for (what I would consider) fairly small changes e.g. updating the OS. How does this relate to the application level? Will we be able to do new releases without having to do a new penetration test?
Any advice on how a startup should approach this is appreciated. Of course I understand only a QSA can give the final word.
Update: Thanks for the responses, I should've read the PCI penetration testing guidance document before posting this question. From that document the scope of the system seems particularly important to get right.