Contents
What effects does PCI compliance have on the website?
If you operate an ecommerce site, PCI compliance is mandatory. It is not dictated by the volume of transactions or restricted solely to storage, transmission, and processing; it applies to any business that allows credit card payments. With PCI, everything is about reducing the attack surface.
How is PCI compliance calculated?
A: To satisfy the requirements of PCI, a merchant must complete the following steps:
- Determine which self-assessment Questionnaire (SAQ) your business should use to validate compliance.
- Complete the self-assessment Questionnaire according to the instructions it contains.
How are SSL certificates and PCI compliance related?
SSL Certificates and PCI Compliance. The proper use of SSL certificates is only a small part of the PCI (Payment Card Industry) requirements but it is an important one. Other requirements include security assessments and ASV scans, and depend on the number of credit card transactions your company processes.
Is the SSL certificate on the server valid?
The server itself has a valid SSL certificate, but it does not match each domain (as we add/remove domains all the time as clients move around). Seems SecurityMerics is the only ASV that marks this as failing PCI. Trustwave, McAfee, etc… do not see this as failing PCI.
What is the impact of a wrong SSL certificate?
Impact: The commonName (CN) of the SSL certificate presented on this service is for a different machine. The mail server uses sendmail (patched) and provides email service for a number of domains. The server itself has a valid SSL certificate, but it does not match each domain (as we add/remove domains all the time as clients move around).
Can a third party company validate PCI compliance?
A: Yes. Merely using a third-party company does not exclude a company from PCI DSS compliance. It may cut down on their risk exposure and consequently reduce the effort to validate compliance. However, it does not mean they can ignore the PCI DSS. Q9: My business has multiple locations, is each location required to validate PCI compliance?