Re: PCI audit and 3rd Party hosted software.

On 12/16/2009 10:28 PM, Tom Jedrzejewicz arranged the binary bits such
that:

On Wed, Dec 16, 2009 at 8:06 PM, Roger Vicker, CCP <rv-tech@xxxxxxxxxx>wrote:

Tom,

Actually A and C are the same company. Unless by "shared files" you mean
the MS Office type documents which are on the Y's local server. Or,
unless you mean C is the company that gives the merchant account. A/C
has their own web site that the Y users do all their business work through.

Using my definitions .. the Y itself is A. They don't need to submit their
network for the audit unless they have transaction or cardholder info on
their server. But getting the auditor to believe that no cardholder info
ends up stored locally is a long putt. And don't forget about email ..
almost certainly this data ends up in email somehow.

That long put seems to be one that even Tiger could never make.

And yes A/C is the one that is saying "not us" but they are the biggest
target of attackers as they store the credit card information and
transmit them to the credit card network upon instructions from the Y.

The Y needs to give C an ultimatum .. demonstrate PCI compliance or lose the
Y as a customer. If they can't, the Y is taking a huge risk having them
handle member credit cards! If C has as their own audit demonstrating PCI
compliance, that should be sufficient for the Y auditors.

BTW .. out of curiosity how are you involved in this? I hope that you are
billing them your highest rate for the time and effort.

Second problem is there really aren't that many sources of
services/software tailored to Ys.

As their only technically proficient person. Fortunately, so far I
haven't really had to do anything much extra but try and point out where
the questions aren't squarely aimed at the right target.

Roger