Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're required to become PCI-DSS compliant so we can process client payments via our website and in the office. Our network is made up of a single SBS 2008 server and 10 workstations, all connected to a single LAN on a Dell Switch. The Internet router is a DrayTek 2820n.

Would anything need to be done to our existing network setup to make it PCI-DSS compliant?

share|improve this question

closed as not constructive by Sven, MadHatter, MDMarra, Iain, voretaq7 Dec 7 '11 at 21:21

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Outsource it to a payment processor. PCI is a PITA. How many payments are you processing on a monthly basis? –  mahnsc Nov 7 '11 at 13:49

2 Answers 2

Outsource it. Seriously, if you don't know PCI already you'll hate it by the time you get to know it. In an office that small there's no justification for processing payments inhouse. Use a 3rd party provider (like PayPal, your bank might also have options). Getting your network certified will likely cost you an arm and a leg. Using a 3rd party service will cost you a bit extra on every transaction, but the break-even point is going to be thousands of transactions (or more).

share|improve this answer

Yes, a great deal will need to be done. First of all, the list of security standards are here: https://www.pcisecuritystandards.org/security_standards/

This entire list applies to all size environments. The only thing that changes depending on how many credit card numbers you process and whether or not you are a service provider for other retail storefronts is the level of audit that must be performed on a regular basis.

If you've never been through the process before, and your environment doesn't require a third-party audit, I recommend going through at least one audit the first time to have some assurance that you've followed the guidelines listed in the Security Standards documents.

If at all possible, I highly recommend avoiding PCI compliance requirements by using a third-party payment processor. Full compliance is a very expensive endeavor.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.