We are relatively small software company who has a requirement to store PAN's for our customers. Hosted payment solutions just don't fit our product requirements. We literally have 3 lines of encryption Code in C# which currently uses Ent Lib.
We have taken some consultancy from a very knowledgeable QSA and we have worked out how we are going to fundamentally re-architect our solution so that whole product doesn't fall under the scope of PCI compliance which would stop our ability to innovate.
I now have a shopping list and a very tight budget. The one item that is causing me a significant headache is PCI key management solution. HSM's are expensive and the equivalent software solutions are also surprisingly expensive. We consistently getting quotes in the region of £30,000 to £50,000 for something I would expect to be no more than £1000 per server plus free dev licences. We only require 2 servers with a luke warm standby to access the secure keys. It seems the letters PCI are adding zeros onto the price for something that conceptually not be that hard!
Is anyone using cost effective solution their QSA is happy with. I get the feeling the QSA's want the Rolls Royce/Ferrari when an entry level Mini would do for a lot of companies. I am happy to spend money and I guess I have reset my sights a little but something under £5000 would be a realistic budget for us.