0

What type of PCI 4.0 Assessment are Service Providers doing when they have no CDE, they do not accept or process credit cards, but instead use another service provider for those services?

4
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Commented May 24 at 15:13
  • related security.stackexchange.com/questions/175145/…
    – schroeder
    Commented May 24 at 15:40
  • We are being asked to complete a full RoC, which we are doing. The challenge is in scoping. An iFrame is used to hand off all credit card acceptance and storage to a third party. We have no CDE. The Service Provider additional requirements don't seem to account for that. I was wondering if anyone else was in the same situation, being a service provide that uses a service provider who has the CDE. Commented May 26 at 1:55
  • @MarcF.Schultz Since a compromise in your webpage could lead to a malicious iframe being loaded instead of the correctly compliant one, your site is in scope. It's just that without ever seeing or having access to the card data, a lot of the questions can be answered with a "N/A". You still have to actually consider them and ensure the appropriate protections for your website's code and configurations, though.
    – Bobson
    Commented May 26 at 7:56

0

You must log in to answer this question.

Browse other questions tagged .