3

Setting up a new company with ecommerce app, and looking at PCI compliance.

What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire?

The context in which we will be processing payments will be in one of the following scenarios:

Option 1 PayPal pro - credit card information is processed on our domain and website, but is not stored in our database - it is simply transmitted to PayPal.

Option 2 SagePay server & inIframe - credit card information is entered on our website, but never hits our system because the SagePay hosted Iframe sends the data directly to SagePay.

Any advice appreciated. I have read PCI documentation, but still unsure about the process.

migrated from serverfault.com Apr 20 '11 at 18:16

This question came from our site for system and network administrators.

5

No, the point of the self-questionairre is that you don't need a QSA.
On the other hand, you might want some assistance or guidance, to verify that you complete it correctly - you still may be subject to an audit, and you'd be worse off after filling it out incorrectly.

Also, you'll still need an ASV (authorized scanning vendor) to run your quarterly scans.

  • 1
    +1 for having someone (e.g. knowledgeable consultant) sit with you the first time you do this – voretaq7 Apr 22 '11 at 16:23
  • +1, thanks that clarifies that. I wasn't aware that the scanning vendor can be a separate entity. – gb2d Apr 26 '11 at 14:10
  • @BombDefused, ASV usually is seperate from QSA, though they don't have to be. (Usually ASVs have a cheaper per-hour rate than QSAs too, so consider shopping around.) Another point you should pay attention to: network ASV and application ASV are not always the same. These are two seperate requirements in the PCI, and some ASVs do one, but not the other. – AviD Apr 26 '11 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.