4

I am working with a company that is "PCI Compliant" and in order for them to give me any of their data (customer name, email) they ask that I be "PCI Compliant" even though this data is not credit card related. Very new to PCI but in reading I guess I fit in the SAQ D but not sure.

Edit: This is a spreadsheet with 2 columns (name, email) uploaded to me by a web form that's run on port 80

Edit2: Even if you are not doing any processing can you still say that your environment meets PCI DSS 2.0? Like AWS says that their EC2 environment has been validated by a QSA?

Improve this question
4
  • 1
    The answer to this question depends on what function you are going to perform for this company. Also, how will you be receiving their data? Will you have access to their card holder environment?
    – Joe Gatt
    Mar 20, 2013 at 17:47
  • Would it be accurate to update your question to say that you are not touching any PCI? There is a huge difference between not touching vs not holding PCI. Your post seems to indicate that you are not even touching it.
    – AJ Henderson
    Mar 20, 2013 at 18:21
  • EC2 would be a host holding the PCI data in some cases, see 12.8. With a hosting provider they sometimes do a partial PCI attestation on the areas they cover to help clients meet full PCI compliance to reduce redundant audit requests.
    – Eric G
    Mar 21, 2013 at 23:16
  • @HK989 - it looks like you have accidentally created multiple accounts. Please see stackoverflow.com/help/user-merge for guidance on how you can merge them back together.
    – Rory Alsop ♦
    Mar 22, 2013 at 7:42

3 Answers 3

Reset to default
10

This is a bit of a weird request. Only the Primary Account Number (PAN), Cardholder Name, Expiration Date and Service code are Cardholder Data.

Directly from PCI-DSS under the header PCI DSS Applicability Information

The primary account number is the defining factor in the applicability of PCI DSS requirements. PCI DSS requirements are applicable if a primary account number (PAN) is stored, processed, or transmitted. If PAN is not stored, processed, or transmitted, PCI DSS requirements do not apply.

Thus, if you are not storing, processing or transmitting the Primary Account Number, then you are automatically PCI DSS compliant as no requirements apply to you.

Improve this answer
2

I would recommend asking them to setup a meeting between your company, their company, and their qualified security assessors (QSA). It sounds like they are worried about some of the requirements in Section 12 of the DSS(See the Reporting Instructions for Details).

Depending on what you will actually be doing may affect the scope. The company may also be overly cautious. If they properly isolated their PCI data into a "card island" and you are not dealing with payment info, your services should not be in scope. The devil will be in the details, if you expand your question I will try to focus and provide more relevant references.

Some of the specific clauses from the DSS which are relevant here are as follows:

12.1 Examine the information security policy and verify that the policy is published and disseminated to all relevant personnel (including vendors and business partners).

12.8 If the entity shares cardholder data with service providers (for example, back-up tape storage facilities, managed service providers such as Web hosting companies or security service providers, or those that receive data for fraud modeling purposes), through observation, review of policies and procedures, and review of supporting documentation, perform the following:

...

12.8.2 Maintain a written agreement that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess.

...

12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement.

...

Improve this answer
1
  • 1
    It is worth clarifying that 12.1 means that the PCI-DSS covered entity needs to share their policy with vendors. 12.8 only applies if they share PCI with you (in which case you would fall under PCI-DSS in many other sections.)
    – AJ Henderson
    Mar 21, 2013 at 1:41
1

In terms of what you've stated in your question the following appears to hold true:

1) You do not handle cardholder data in any capacity at any time.

2) You do not provide managed services which involve connectivity to that client's systems or environment at any time.

As such, there is no reason for you to be PCI compliant. You are outside of the scope of compliance and should inform the client of this.

The EC2 environment is validated such that businesses handling cardholder data can run services on that infrastructure. Those businesses will still have to validate their own compliance.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .