I have a legacy system that collects and stores credit card numbers ( BAD! ). We are in the process of replacing that system in phases. We are going to integrate with a credit card processing system that requires us to be Level 4 Compliant. The new system will not do the bad stuff ( storing credit card info ), but both systems will run on our network at the same time. Will I be able to achieve PCI Level 4 for the new system so that we can do the integration even though the old legacy system is still running?

  • 2
    i quite dont think so... Get rid of the credit card numbers first. Not sure though...couldn't understand you really
    – cengizUzun
    Feb 14, 2014 at 15:28
  • 4
    I'm afraid the only person who can effectively answer your question is your QSA. As I understand it (and I hasten to add I'm not a QSA), it's cardholder environments that are certified, so if the old system is in the same environment as the new one it would be tricky to see how that could get certified. However as I say best bet is to ask the QSA... Feb 14, 2014 at 15:43

2 Answers 2


Read the document: https://www.pcisecuritystandards.org/documents/PA-DSS_v3.pdf

On page 7, there's a table that outlines what you can and can't store. If your legacy system only stores the allowed data, then you can theoretically get compliance, but you'll have some really really really strict security requirements for your network and systems.

IMO, it's just not worth it to do your own CC transactions in-house, unless that's your primary business.


It really sounds like you need an auditor to set things straight. It sounds like you are under the impression that if you don't store CC numbers, then PCI compliance is easy or straightforward. It's not really like that. The level of the merchant doesn't change the PCI requirements. The level just changes your chance of getting an audit or being required to have a QSA perform an audit every so often.

Storing credit card numbers isn't non-compliant, you just need to meet all the requirements (section 3.4 IIRC). Encryption of card numbers (PAN - primary account number) is actually only a small, though tricky (due to key management), part of PCI compliance. All the other requirements still apply even if you only take the PAN and immediately pass it to a compliant third party. If the PAN touches your RAM for a nanosecond, then that system, its software, network, etc. are all within PCI scope.

If you are otherwise PCI compliant, then getting an exemption for some of the PAN storage for a limited time should not be hard to arrange with your auditor. Move the database to another server, use full-disk encryption, and have the keys stored and entered by someone. Something like that might be enough to get an exemption for a few weeks while you switch to the new system.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .