4

We're required to become PCI-DSS compliant so we can process client payments via our website and in the office. Our network is made up of a single SBS 2008 server and 10 workstations, all connected to a single LAN on a Dell Switch. The Internet router is a DrayTek 2820n.

Would anything need to be done to our existing network setup to make it PCI-DSS compliant?

1
  • 1
    Outsource it to a payment processor. PCI is a PITA. How many payments are you processing on a monthly basis?
    – mahnsc
    Nov 7, 2011 at 13:49

2 Answers 2

5

Outsource it. Seriously, if you don't know PCI already you'll hate it by the time you get to know it. In an office that small there's no justification for processing payments inhouse. Use a 3rd party provider (like PayPal, your bank might also have options). Getting your network certified will likely cost you an arm and a leg. Using a 3rd party service will cost you a bit extra on every transaction, but the break-even point is going to be thousands of transactions (or more).

3

Yes, a great deal will need to be done. First of all, the list of security standards are here: https://www.pcisecuritystandards.org/security_standards/

This entire list applies to all size environments. The only thing that changes depending on how many credit card numbers you process and whether or not you are a service provider for other retail storefronts is the level of audit that must be performed on a regular basis.

If you've never been through the process before, and your environment doesn't require a third-party audit, I recommend going through at least one audit the first time to have some assurance that you've followed the guidelines listed in the Security Standards documents.

If at all possible, I highly recommend avoiding PCI compliance requirements by using a third-party payment processor. Full compliance is a very expensive endeavor.

Not the answer you're looking for? Browse other questions tagged .