3

I was wondering if anyone has any experience with an employer that is requesting their site be made PCI Compliant whilst not having any credit card data stored or transmitted through it.

The site is for a restaurant, and they do have links to a site that sells their gift cards and a site that takes reservations and requires a credit card for certain sized parties, but beyond that, it is an informative site with images and doesn't sell anything on its own.

The client states that the bank is requiring PCI Compliance because of those links on the page, despite not store or transmitting via any form on its own.

Just wondering if anyone had dealt with a situation like this in the past and if the Self-Assessment Form was sufficient for a bank requesting PCI Compliance. Some of the rules seem a bit extreme.

  • Thanks for the answer. I just want to confirm. The restaurant, their POS Stations and all internal activities are PCI compliant. They hired me to design a website which has a couple of links to OpenTable. They are now saying they need that website to be PCI compliant as well after a few years. The site sends clients to a third party with anything requiring CC info. So the site itself never touches CC, store or transactions. Which is the reason I'm questionining how deep this PCI Compliance needs to be. Thank you again for your response. – Dave Jan 21 '17 at 3:10
3

You do need to be PCI compliant because you do capture and handle credit card information. It doesn't require you sending it to a bank or storing it. Just having it in your system at any time puts you within PCI scope.

The self assessment is good but to be sure you are actually 100% compliant you should have an auditor check your system. They will be unbiased and detail issues you may not be aware of.

Whomever is telling you that you need to be PCI compliant because you link to sites that accept credit cards for payment is mistaken. Your site does not have credit card information pass through your system so you are outside of the scope of PCI. But, if you share a database with any of these sites and have access to their payment data you enter a gray area and probably either fall under PCI already or will soon because the rules gets stricter every year.

  • I do not believe the OP's site is taking CC info, however, it is probably good anyway to be compliant despite the costs. While it may not be necessary, keep in mind that Banks and Insurance companies can make demands for reasonable and sometimes senseless reasons. Most of the time, complying is in the best interest of the company. I have gone through insurance audits of IT sites and while some of it seemed silly, there was always a good reason for the requirement in its original form. – closetnoc Jan 21 '17 at 5:25
  • After re-reading the question you are correct. They have no PCI exposure here. I'll need to rewrite my answer. – John Conde Jan 21 '17 at 17:23
  • I was agreeing with you in that it is probably a good idea even if not really really really necessary. It is a bit strange that a bank is requiring this when the site does not take CCs, however, it may simply be fear that it could be implemented later. A bit of CYA since banks are often involved. Cheers!! – closetnoc Jan 21 '17 at 18:03
  • Thank you very much for the replies. I'll be taking the necessary steps to get compliant. For future reference for anyone else, it's Cathay Bank that is requiring Compliance at this time. Their concern is a hack that would result in malicious links to the other sites that would be compromised. Seems a bit extreme, but understandable I suppose. – Dave Jan 22 '17 at 4:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.