(Edited & added more information at the bottom of this question)
I've been tasked with "testing" a client's Linux web servers, running cPanel (which they own and mostly manage, until they come to me from time to time for help) for PCI Compliance. The client isn't doing anything with e-commerce now, but would like to consider it in the future.
I don't hold any security certs, but did go back to my alma mater last fall for a semester-long course in IT Security, in which the focus of the course was the 10 domains included in the CISSP certification. I've also done research on PCI Compliance in the past (and in one case a couple years ago, had to reprimand a small payment processor for asking me to allow one of my clients to store credit card data in plain-text format on a server I managed).
I'm basing my recommendations to my current client from that course as well as from the research I've done on PCI Compliance.
I've downloaded the Self-Assessment Questionnaire C-VT from the PCI Security Standards website, and have also downloaded the Navigating PCI DSS v2.0 document.
That said, I'm more interested in tests (or checklists) against the actual server I can perform. I found that McAfee and cPanel have a (free) cPanel plugin that will allow up to 4 scans a year. I've also found a couple of external free PCI scans (here and here).
I'm wary of "free" scans out there, especially if you don't know the organization behind the scan. However, my client understandably doesn't want to pay for a scan (other than my time) because they're not actually pursuing compliance or doing anything ecommerce right now (they just want to be prepared). They're also a nonprofit organization so don't have much cash.
So I have 3 related questions:
- Are there any "free" scans you'd recommend or not recommend for testing a server?
- Do you have any thoughts on McAfee's plugin for cPanel?
- Are there any checklists (other than the PDF Documents available at pcisecuritystandards.org) that I can use to do a "self test" on the server and manually test it for PCI compliance?
Edit for More Information
Based on the feedback below in the form of answers and questions, I'd like to clarify a few things. The client isn't going through any official security audit or PCI Compliance test. They'd just like to have a good idea of what they're doing right, what needs work, and what they would need to focus on in the future if they do decide to process transactions through their server.
I chose the C-VT, because I read this in its introduction:
Web-Based Virtual Terminal, No Electronic Cardholder Data Storage
If I'm hearing you guys correctly, I've made a wrong assumption, and the C-VT has nothing to do with websites, but instead, has to do with actual CC terminals. I'll take a look at SAQ-D. Thank you for that suggestion.
Thanks for the answers thus far. (End Edit)