What steps do I need to go through to become PCI compliant if I’m merely capturing billing information and sending it straight to the gateway.
Does it cost money to become PCI compliant?
I have always avoided this issue by using PayPal and Google Checkout. (I am thinking about trying Amazon Payments as well.) I also have friends who use other gateways like Authorize.net.
I would avoid keeping customer credit card numbers. Too much responsibility and another thing to worry about. Besides, there are lots of good companies willing to do it for you.
I’m not really interesting in storing credit card numbers as well.
I understand if that was the case, I would need additional security measures on my server.
I’m asking for just capturing credit card numbers and sending them straight to the gateway.
Obviously over SSL.
What does it take to achieve PCI compliance in this case.
Hello,
PCI DSS (Payment Card Industry Data Security Standards) was developed by the major credit card companies to assist merchants in preventing credit card fraud and to improve security around processing and storing credit card details. Therefore, if the shoppers credit card moves through your computer servers to get to the payment gateway then you will need to have your servers made PCI compliant, even if you are not storing the credit card information.
There are different levels of PCI compliance, level 1 being the highest level of compliance and level 4 being the lowest. The total number of customer transactions you are processing through your servers will dictate the level of PCI compliance you must meet. This usually means paying for an independent security audit of your systems on a regular basis. The lower PCI compliant levels require less frequent quarterly checks, higher level PCI compliance requires more stringent security audits on a more frequent monthly basis.
This is a good page from Sage Pay that will give you a good idea of their different PCI requirements for their merchants:
http://www.sagepay.com/products_services/bolt_ons/pci_dss/which_level
Shopintegrator has some good information on PCI DSS compliance and what you should be aware of when working toward meeting the compliance requirements. They are also correct that knowing which PCI compliance level you need to achieve is important, since will determine the steps you will need to take to achieve PCI compliance. <snip/>
My understanding – and I’m not the guy in charge of understanding PCI compliance here, more on the execution side – is that if your system “sees” the numbers, you are required to make the entire network PCI compliant.
Not sure if it directly costs to become PCI compliant, but making the necessary changes is painful and can be expensive depending on what is required.
I’d offload the sales to some 3rd party processor.
Most sites providing payment processors should allow you to have the page where the credit card number is entered on their server instead of yours so that you can avoid the issue of ensuring that your server is PCI compliant because the credit card number never passes through your server.
If the credit card number passes through any server then that server is required to be PCI compliant - it could work out very expensive for you if you process credit card numbers without being PCI compliant because then you might be held liable to make good any losses people suffer through misuse of any credit card number that might (or might not) have passed through your server.
^^^Exactly. And it isn’t just the server – the requirement extends to the entire network.
For a merchant to become PCI compliant, the merchant has to assess the merchant level relevant for the PCI guidelines, as each different merchant level will have different requirements.
To give you a general idea of how to determine your PCI compliance level, here are Visa’s PCI compliance level definitions:
PCI Compliance Level 1 - Merchants processing over 6 million Visa transactions annually (all channels) or Global merchants identified as Level 1 by any Visa region
PCI Compliance Level 2 - Merchants processing 1 million to 6 million Visa transactions annually (all channels)
PCI Compliance Level 3 - Merchants processing 20,000 to 1 million Visa e-commerce transactions annually
PCI Compliance Level 4 - Merchants processing less than 20,000 Visa e-commerce transactions annually and all other merchants processing up to 1 million Visa transactions annually
Depending on your compliance level, complete the appropriate requirements. Then for each payment card brand you accept, check the site to see what kind of reporting you have to supply each brand.
Finally, a self-assessment questionnaire on a prescribed format needs to be submitted to the acquiring bank by the merchant or service provider, which acts as a checklist to ensure that the necessary requirements have been addressed and met.
As indicated above… there’s a few pieces to the puzzle:
- Your software/script
- The datacentre where your server is hosted
- Your individual server
- The network
- Merchant internal systems
There are several companies that can help you with the self assessment (e.g. scanning your site to check for possible vulnerabilities) - do a quick search on Google.
Another thing to keep in mind is whether you’re capturing the card details on your site (the merchant) or whether you’re using the gateway’s hosted payment page.
You are right.
In fact there are about 12-15 architectural requirements that your bank will give you while applying for PCI compliance. You have to address and meet all requirements to become PCI compliance.