PCI Compliance
We recommend Security Metrics as a PCI compliance provider. They make the entire process more understandable than any other company we've worked with. They have a user-friendly website and good customer service. We do not make any money Security Metrics. We just like these folks.
SecurityMetrics "Quarterly" Site Certification
- 12-month service
- PCI approved vulnerability scanning
- Online PCI Self-Assessment Questionnaire
- Scans performed each quarter
- Unlimited rescanning
- Unlimited calls to customer support
- Use of Site Certified logo
- Acquirer reporting
Requirements
All Merchants (Levels 1, 2, 3 & 4)
- Quarterly external vulnerability scans
- Annual self-assessment questionnaire (Levels 2, 3, & 4)
- Annual onsite PCI audit (Level 1 only)
Solution
SecurityMetrics simplifies the compliance process for merchants. SecurityMetrics Site Certification helps merchants quickly and easily validate PCI compliance.
PCI DSS Basic Requirements
Testing is required for all external IP addresses (Internet connection points such as your company website, mail server, firewall, dial-up modem, wireless AP, etc.).
A good rule of thumb is if you can surf the web or have email at your business then you need to be tested. If you do not have an Internet connection then you should purchase the "Site Certification No Internet" product.
|
The information below is reprinted from www.securitymetrics.com
The Payment Card Industry (PCI) Data Security Standards (DSS) are now required for all merchants, including:
- Retail (brick-and-mortar)
- Mail/telephone order
- e-Commerce
All major credit card associations such as Visa, MasterCard, American Express, Discover, Diners Club and JCB all endorse, and require the unified PCI Data Security Standards.
Both Visa and MasterCard impose fines for non-compliance. For fine information see the Visa or MasterCard compliance regulations.
Safe Harbor
Visa defines safe harbor as the following: "Safe harbor provides members protection from Visa fines and compliance exposure in the event its merchant or service provider experiences a data compromise. To attain safe harbor status:
1. A member, merchant, or service provider must maintain full compliance at all times, including at the time of breach as demonstrated during a forensic investigation.
2. A member must demonstrate that prior to the compromise their merchant had already met the compliance validation requirements, demonstrating full compliance."
|
