I recently received several emails from CyberSource informing me that they will begin requiring "PCI-DSS compliance validation" from all their vendors. I am a CyberSource client through my usage of Authorize.Net, so I assume that I am not the only CG user to get one of these alerts. From the research I've done, it looks like I can simply complete the shortened questionnaire myself, since all my processing is handled via CheddarGetter and Auth.Net's Customer Information Manager.
Is there anything specifically I should be aware of, in regards to CG's part in this equation? Just want to make sure I cross all the T's and dot all the I's...
#1 Posted by Marc Guyer Support staff on 09 Jun, 2010 06:51 PM
RIght -- you should be able to complete the SAQ. There are some services out there that make it a little easier (for a fee of course). They also perform the require quarterly scans of your network. You might try https://www.trustkeeper.net or http://www.mcafeesecure.com/us/pci-intro.jsp
Marc Guyer closed this discussion on 09 Jun, 2010 06:51 PM.
Frank Koehl re-opened this discussion on 09 Jun, 2010 07:11 PM
#2 Posted by Frank Koehl on 09 Jun, 2010 07:11 PM
As far as I know, this doesn't apply to users of your service. They fall under SAQ A: "Card-not-present (e-commerce or mail/telephone-order) merchants, all cardholder data functions outsourced."
This URL has the full list of SAQ categories:
https://www.pcisecuritystandards.org/saq/instructions_dss.shtml#instructions
Or am I reading that wrong?
#3 Posted by Marc Guyer Support staff on 09 Jun, 2010 07:52 PM
Technically, since your server touches the cardholder data before it's sent to CG, not all functions are outsourced.
We're working on a transparent redirect feature that will work around this issue but it wont be ready for a couple of months and will require some adjustment in your app.
Marc Guyer closed this discussion on 09 Jun, 2010 07:52 PM.