Re: PCI audit and 3rd Party hosted software.

On Wed, Dec 16, 2009 at 8:06 PM, Roger Vicker, CCP <rv-tech@xxxxxxxxxx>wrote:

Tom,

Actually A and C are the same company. Unless by "shared files" you mean
the MS Office type documents which are on the Y's local server. Or,
unless you mean C is the company that gives the merchant account. A/C
has their own web site that the Y users do all their business work through.

Using my definitions .. the Y itself is A. They don't need to submit their
network for the audit unless they have transaction or cardholder info on
their server. But getting the auditor to believe that no cardholder info
ends up stored locally is a long putt. And don't forget about email ..
almost certainly this data ends up in email somehow.

And yes A/C is the one that is saying "not us" but they are the biggest
target of attackers as they store the credit card information and
transmit them to the credit card network upon instructions from the Y.

The Y needs to give C an ultimatum .. demonstrate PCI compliance or lose the
Y as a customer. If they can't, the Y is taking a huge risk having them
handle member credit cards! If C has as their own audit demonstrating PCI
compliance, that should be sufficient for the Y auditors.

BTW .. out of curiosity how are you involved in this? I hope that you are
billing them your highest rate for the time and effort.

---------
Tom Jedrzejewicz
tomjedrz@xxxxxxxxxxxxxx