Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've read a lot about PCI DSS and its requirements, but I'm unclear on what exactly determines whether an organization needs to worry about PCI DSS compliance.

We accept payments using a basic HiSpeed 6200 POS terminal which is connected to the internet through our office LAN. We aren't using VLAN's. The terminal isn't integrated with any payment processing applications, it just prints out paper receipts.

Do I need to worry about PCI DSS compliance?

share|improve this question
1  
Most initial answers provided are a partial picture at best. I suggest you do further research. –  Warner Jan 17 '11 at 1:56

4 Answers 4

up vote 4 down vote accepted

Generally, if you store payment card data somewhere, you will be audited by the PCI-DSS police(AMEX,VISA,MASTERCARD). If you are using a 3rd party for the transactions and storing of payment card data, then they should be able to provide you with their PCI-DSS audit report/certification. They may also require you to comply to their rules, via service agreement/contract.

share|improve this answer
    
In Canada, almost everybody can accept credit card payments. So can I assume that nearly every business is subject to PCI DSS? –  Nic Jan 16 '11 at 0:43
    
The key word for the most part is "store." I should probably make that word bold above. If you STORE credit card info, you are most certainly obligated to PCI DSS. Additionally, you will have to have processes and procedures in place for your computers that actually take payment. –  JakeRobinson Jan 16 '11 at 0:55
    
Although it wasn't exactly the answer I was looking for, your response did lead me to my eventual conclusion so I am accepting your answer. –  Nic Jan 16 '11 at 2:14
1  
Jake, your answer is completely incorrect. PCI DSS mandates that any merchant who takes payments through the participating card schemes must be PCI DSS compliant. This is even the case if you don't handle the payments yourself and pass the request off to a gateway. It is the merchants responsibility to ensure that all links in the chain are PCI DSS compliant, NOT the payment providers and it doesn't even matter if you don't store the cards. Simply by having a merchant number you are liable. –  pobk Jan 16 '11 at 13:20
    
@pobk I completely agree with you, but I fail to see how the answer is completely wrong? –  JakeRobinson Jan 16 '11 at 21:39

Yes, anybody who accepts Visa payment must be PCI DSS compliant.

All merchants who are involved in the Visa payment process are required to be compliant with the PCI Data Security Standard. The standard is the foundation for the Account Information Security Program.

Source: Visa Account Information Security Merchant Guide

However, Visa does not require level 4 merchants to validate their compliance.

Level 4 Merchants: Completion of the Annual PCI Questionnaire and the PCI Security Scans are optional, but highly recommended. Based on Acquires discretion, certain Level 4 merchants may need to validate compliance with the PCI DSS. Although Level 4 merchants are not required to validate compliance at this time, their network must be PCI-DSS compliant.

Source: Fraud Prevention & Security, Merchant Resources | Visa.ca

share|improve this answer

Your bank will be best placed to advise you on this.

However from what you've detailed in your question, you are accepting payments by a hand-held terminal. This will be printing off receipts for the cardholder and a merchant receipt for your records.

Those merchant receipts are called 'paper media' under the DSS and you are mandated to store those receipts securely and only authorised personnel should have access to them. DSS even mandates how media, physical or electronic is handled, recorded and disposed of.

If you in any doubt at all, call your bank who will be able to clarify the position, but from what you've detailed here, you are required to be PCI DSS compliant.

share|improve this answer

If you store, transmit, or process "Account Data" you must be PCI compliant. Within the PCI DSS 2.0, "Account Data" consists of both "Cardholder Data" plus "Sensitive Authentication Data."

Cardholder Data includes:

  • Primary Account Number (PAN)
  • Cardholder Name
  • Expiration Date
  • Service Code

Sensitive Authentication Data includes:

  • Full magnetic stripe data or equivalent on a chip
  • CAV2/CVC2/CID/CVV2
  • PINs/PIN blocks

When the exact definition is in question, the glossary helps.

How this data is handled determines what PCI Self Assessment Questionnaire (SAQ) is applicable to your business. Unfortunately, you do not provide enough information for me to confidently identify what SAQ is applicable to your business. An excerpt from the SAQ guide should help:

SAQ A -- Card-not-present (e-commerce or mail/telephone-order) merchants, all cardholder data functions outsourced. This would never apply to face-to-face merchants.

SAQ B -- Imprint-only merchants with no electronic cardholder data storage, or standalone, dialout terminal merchants with no electronic cardholder data storage

SAQ C-VT -- Merchants using only web-based virtual terminals, no electronic cardholder data storage

SAQ C -- Merchants with payment application systems connected to the Internet, no electronic cardholder data storage

SAQ D -- All other merchants not included in descriptions for SAQ types A through C above, and all service providers defined by a payment brand as eligible to complete an SAQ.

Additionally, the volume of transactions you process determines what PCI level is applicable to your business. While this varies between card companies slightly, they are usually very similar. Additionally, the requirements for levels vary between Service Providers and Merchants. All levels require quarterly scans. Most require annual self assessments. Finally, at level 1, you must have a Qualified Security Assessor (QSA / auditor) complete your Report on Compliance. (ROC)

While if you fall under the qualifications identified above, you will officially have to be PCI compliant on some level. Nevertheless, your bank or acquirer is going to ultimately determine your PCI reporting requirements. Do your homework and then contact your bank, they are your best bet for determining the final expectations.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.