1

I was part of a team that developed an e-commerce website (built with Wordpress & WooCommerce) for a client. They use StripeJS and PayPal Standard to process payments, and the site is hosted on a dedicated server with TLS from a trusted certificate authority. The client's digital security manager determined they needed PCI-DSS SAQ A-EP (which tallies with what Stripe themselves say). So far, so good.

However, now the client's bank have requested copies of their PCI SAQ, and asked us (as the website developers) to fill out a copy of the same SAQ in addition to the client's/merchant's copy. The bank have also separately asked for the hosting company to do the same.

As far as I'm aware, SAQ A-EP is only applicable to the merchant. We can certainly help them to fill it out, but I don't think we're supposed to be doing a separate one. Someone in the office suggested we should fill out SAQ-D and submit that instead, but as far as I can determine, SAQ D is supposed to be for merchants who don't fulfil any other SAQ category. I've suggested we push back on this, as it all seems a bit unclear.

Should we, as web developers (who are not at all involved with either hosting or payment processing), be completing a separate SAQ document when the merchant themselves are compliant with SAQ A-EP?

Note: at present we don't have a contractual liability clause with them, as the site quickly evolved from a static brochure to full online store in a very short period of time. We will be remedying this shortly.)

4

tl;dr you should probably contact a QSA and get them to help you navigate this. It sounds like the merchant is big enough to have the attention of their acquiring bank, which means you need to be on your game.

I am not a QSA, nor am I your QSA, but I do deal with PCI quite a bit. Depending on how you've implemented Stripe the merchant may actually qualify for the SAQ A, which is much preferred to the A-EP from your perspective.

However, if you go forward with the A-EP, here is why they're asking for stuff from you and the hosting provider:

Requirement 6: Develop and maintain secure systems and applications

The merchant didn't develop any of the software, they relied on you. Therefore the bank is going to expect you to pick up your end of requirement 6 as well as probably some others (12 comes to mind).

Requirement 1: Install and maintain a firewall configuration to protect cardholder data

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs

Requirement 8: Identify and authenticate access to system components

Requirement 10: Track and monitor all access to network resources and cardholder data

Requirement 12: Maintain a policy that addresses information security for all personnel

These are all likely applicable in some fashion to the hosting provider, as well as some I am sure I missed. This doesn't mention the additional requirements for shared hosting providers. Now, many reputable hosting companies are already PCI assessed and can provide an AOC on request (like AWS, for example).

Now, since neither you nor the hosting provider are actually merchants in the banks eyes, you would be filling out the SAQ D for Service Providers. Most of the requirements you can mark as N/A unless they would apply (like requirement 6). Then an authorized officer of your company would sign the attestation of compliance. This lets the merchant mark those requirements as N/A on their SAQ A-EP because they rely on a service provider (you).

Disclosure: I work at Braintree, which competes with Stripe and is part of PayPal, but this same advice would apply there too, unless you do the SAQ A as I mentioned first.

  • Thanks for this. We're waiting to hear back from the client, but looking at SAQ-D it looks very similar in scale & scope, just tweaked for service providers. Considering how quickly the client has scaled up, I think nobody is completely certain what merchant level is applicable to them at the moment. – indextwo Nov 23 '16 at 16:11
  • There is an SAQ D for merchants and a different one for service providers. The service provider one has a few additional questions. Ultimately it is up to their acquiring bank as to what documentation they will require for PCI. – John Downey Nov 23 '16 at 16:13
  • Thanks - that's pretty much the conclusion we reached as well (although various people had to do a lot of digging to even find the different SAQs!). We'll see what the banks says once they get everything. – indextwo Nov 23 '16 at 16:18
  • just wanted to clarify one thing from @JohnDowney answer. If a merchant relies on a service provider to meet a specific PCI requirement, the merchant doesn't mark that requirement as N/A. It should be marked as "In Place", as they are relying on a PCI compliant service provider to assist them in meeting that requirement. – Timee Nov 27 '16 at 15:57
  • That is fair, sorry for the mistake – John Downey Nov 27 '16 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.