I was wondering if anyone has any experience with an employer that is requesting their site be made PCI Compliant whilst not having any credit card data stored or transmitted through it.
The site is for a restaurant, and they do have links to a site that sells their gift cards and a site that takes reservations and requires a credit card for certain sized parties, but beyond that, it is an informative site with images and doesn't sell anything on its own.
The client states that the bank is requiring PCI Compliance because of those links on the page, despite not store or transmitting via any form on its own.
Just wondering if anyone had dealt with a situation like this in the past and if the Self-Assessment Form was sufficient for a bank requesting PCI Compliance. Some of the rules seem a bit extreme.