We run an online software service that collects and transmits card transactions for small merchants. They use card swipe terminals connected to their business PCs that direct the traffic straight through to our secure portal via HTTPS with two factor authentication. These merchants are our customers and their business models and practices are as varied as their names. We don't control what they do inside their office space. Many are not PCI certified yet.
As part of our sign-up service, we purchase the card swipe hardware for them from hardware resellers and have those distributors drip-ship directly to our customers. Over the years we have recommended 3 different Magtek models: Imagesafe, MICRImage, and Dynamag Magnesafe. These components never enter our physical premises. They are purchased by us and shipped directly to the customer. We do not modify them and we do not own them.
So, am I required to track them as part of our hardware inventory under PCI DSS 3.0? If so, I know I would need hardware and serial numbers, policies and procedures for hardening each one, and a way to test and track each one. I'm talking thousands of small merchants, and the thought makes me sick.
My hope is that, because I wasn't the distributor, I can simply send each merchant a set of hardening instructions specific to the brand/model of terminal they have and ask for attestation that they have implemented those instructions. Will that suffice?
My worry is that, because I was the purchaser, I will be on the hook for secure deployment of these terminals in each merchant's environment.
What do you think?