2

Our provider is a shared web host, therefore we don't have any control over software, firewall or logs.

Considering the following requirements, I was wondering if anyone knew whether it was even possible.

Requirement 1: Install and maintain a firewall configuration to protect cardholder data

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs

Requirement 6: Develop and maintain secure systems and applications

Requirement 8: Identify and authenticate access to system components

Requirement 10: Track and monitor all access to network resources and cardholder data

Requirement 12: Maintain a policy that addresses information security for all personnel

Lastly, I would like to apologise for the question, there seems to be very little definitive information in general on PCI compliance.

Improve this question
4
  • Is the payment processing re-direct to another site?
    – Shane Andrie
    Dec 14, 2017 at 15:47
  • No. As long as someone else is system admin, they have access to system components without your knowledge. However, if you use a agent like paypal to collect payments, those rules apply to paypal, not you.
    – vidarlo
    Dec 14, 2017 at 19:48
  • @ShaneAndrie It is happening via a HTTP Post
    – chris.fy
    Dec 15, 2017 at 15:57
  • @vidarlo Many thanks for your response. That is my understanding too, many thanks.
    – chris.fy
    Dec 15, 2017 at 15:58

1 Answer 1

Reset to default
1

Your hosting provider is acting as a service provider for network, operating system, and several other services in the SAQ A-EP. For your compliance, you will need to obtain a copy of their Attestation of Compliance in order to satisfy requirement 12.8. Also, be sure to review their AoC to make sure that the services covered by their AoC are the services you are expecting from them. I have run into situations where the AoC for a hosting provider only covered physical security (requirement 9) but not OS-level requirements.

Finally, this article from the PCI SSC can be helpful: https://www.pcisecuritystandards.org/pdfs/best_practices_securing_ecommerce.pdf

Improve this answer
1
  • @waltonbob Thank you! You have been an unbelievable help. Asking for the Attestation of Compliance is exactly what I needed. If you know of any other good resources on dealing with Service Provider's AoC it will also be greatly appreciated.
    – chris.fy
    Dec 26, 2017 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .