Posting in the Magento forums has been disabled pending the implementation of a new and improved forum solution which should better serve the community.

For new questions please post at magento.stackexchange.com, the community-run support site for the Magento community. We will be providing updates on the new forum solution soon. For questions or concerns please email community@magento.com.

Magento Forum

Page 1 of 2
PCI Compliance - Questions and Answers with Magento Team and Rackspace
 
RoyRubin
Enthusiast
 
Avatar
Total Posts:  968
Joined:  2007-08-07
Los Angeles, CA
 

Have questions on implementing Magento in a PCI compliant manner? Submit your questions to the Magento team and Rackspace in this wiki post.

http://www.magentocommerce.com/wiki/pci_compliance_-_questions_and_answers_with_magento_team_and_rackspace

A participating PCI Security Standards Council Member and a Level – 1 PCI Service Provider, Rackspace provides businesses with hosting solutions for mission-critical deployments. To learn more about the ways Rackspace can help your business we invite you to do so on their site.

And if you have questions about the need for a firewall or implementing a separate server for your database, or maybe you have questions about the recent changes in PCI-DSS v1.2, please submit your questions and the Magento team and Rackspace will answer questions in a post here on the Magento blog.

 
Magento Community Magento Community
Magento Community
Magento Community
 
Cymri
Member
 
Total Posts:  38
Joined:  2009-01-30
 

why were those questions never answered?

 
Magento Community Magento Community
Magento Community
Magento Community
 
drai
Jr. Member
 
Total Posts:  26
Joined:  2009-01-13
 

Great questions, but no answers!

 
Magento Community Magento Community
Magento Community
Magento Community
 
MX01
Jr. Member
 
Total Posts:  1
Joined:  2009-09-29
 

Hi All,

I was wondering where PCI Data Security Standard (PA-DSS) adoption and compliance was at for the Enterprise edition?

Also, what are the implications for Community Edition user of not meeting/not complying with PCI Data Security Standard (PA-DSS)?

For Community Edition users will it be sufficient to use a hosting service that complies with the PCI Data Security Standard (PA-DSS)?

Finally, is non-compliance with PCI Data Security Standard (PA-DSS) a very serious sleeper issue with massive implications that could blow up in our faces or could such conclusions merely be dismissed as scaremongering?

I look forward to reading answers to the questions above and learning more about what PCI Data Security Standard (PA-DSS) means for us all.

Many thanks in advance.

MX

 
Magento Community Magento Community
Magento Community
Magento Community
 
mpenhos
Jr. Member
 
Total Posts:  5
Joined:  2008-10-16
Mexico City
 

if u encourage to make questions, at least answer them wink

Thanks

 
Magento Community Magento Community
Magento Community
Magento Community
 
jgkiefer
Jr. Member
 
Total Posts:  6
Joined:  2010-01-24
 

Anyone able to answer this question?

 
Magento Community Magento Community
Magento Community
Magento Community
 
cvos
Jr. Member
 
Total Posts:  5
Joined:  2008-01-02
 

A new Enterprise edition has been released, is there a timeline for an upgrade to the open source version?

 
Magento Community Magento Community
Magento Community
Magento Community
 
thylaksoft
Sr. Member
 
Avatar
Total Posts:  78
Joined:  2009-12-10
New Castle, DE
 

Hi,
I would like to know when magento community edition would become pci compliant? Is there a plan to do it at all?
Thanks
Thylaksoft

 
Magento Community Magento Community
Magento Community
Magento Community
 
Sal Iozzia - CRE Secure
Jr. Member
 
Avatar
Total Posts:  4
Joined:  2010-02-23
 

I see some people asking about what to do for PCI for Magento Community Edition. I hope this is appropriate to post here…

CRE Secure has released a PCI solution for Magento Community Edition that is now the official PCI solution for Paypal Pro merchants, press release will be hitting the airwaves soon.

We have started a group and will be blogging about the module and our partnerships.
http://www.magentocommerce.com/group/blog/action/viewpost/1213/group/388/

We will be posting our module to the Magento Connect in the days to come.

You can check us out at [url=http://www.cresecure.com]http://www.cresecure.com[/url].

 
Magento Community Magento Community
Magento Community
Magento Community
 
kulturshock
Jr. Member
 
Total Posts:  29
Joined:  2009-11-30
 

It seems to me that this thread, like many on the internet, and the wiki post, both miss the point entirely.

A software program cannot be PCI compliant. It is the merchant that has to be PCI compliant. A software program CAN be PA-DSS approved and Magento enterprise edition is (or soon will be) PA-DSS approved.

I do not know if the community edition of Magento will ever be PA-DSS approved.

What does this mean?

For a merchant to be PCI compliant they have to pass a PCI compliance test. This consists of filling in a questionaire correctly and sticking to a set of rules. It also MAY include the need for the site to pass a PCI scan. The questionaire you have to fill in, the need for the scan and the frequency of the scan depend on the number of transactions you do a year and whether your site accepts credit cards or whether you let a third party site host and accept the cards on your behalf.

This means that simply passing a PCI scan does not in itself make you PCI compliant. It is however a good idea that your site is capable of passing a scan.

The PCI rules change each year (basically they are being phased in) and each year the requirements get harder. A key date in the US (and no doubt soon followed elsewhere in the UK) is July 1st 2010 where it is MANDATORY that payment applications are PA-DSS approved.

Some QA assesors will say that Magento is a payment application if it hosts the collection of credit card information. Thus the community edition of Magento cannot be used after july 1st 2010. HOWEVER I have not heard of ANY QA assesor worrying about MAgento IF the credit card collection is hosted and done on the payment gateway. Clearly the merchant MUST ensure that the payment gateway provider is fully PCI compliant.

Some payment gateways allow the use of iframes so that the interface can look seemless and as if it is part of the site’s processing. I.e. fully integrated in the one page checkout.

In the UK if you look at the Sage Pay web site, you will see the different levels of scan, form filling in etc depending upont the type of interface you use. If you use their popular Direct interface they say that you have to pass the scan and fill in the more complex form. They recommend their server interface which it is much easier to gain PCI complance. Sage do not as yet meantion PA-DSS approval of payment applications, so I assume from this thatthe UK is not pushing this requirement YET.

 
Magento Community Magento Community
Magento Community
Magento Community
 
Shaktisinh.K.Parmar
Jr. Member
 
Total Posts:  5
Joined:  2008-10-16
 

Hi,

We are going to use Authorize.Net as a payment method which is PCI compliance in Magento CE. List of such PSP is given at URL: http://usa.visa.com/download/merchants/cisp-list-of-pcidss-compliant-service-providers.pdf.

Authorize.Net also renews it every year. Reference URL: http://www.authorize.net/solutions/merchantsolutions/merchantservices/security/

So i think now Magento CE will be PCI compliance as merchant is PCI compliance.. What you say?

Regards,
Shaktisinh.K.Parmar

 
Magento Community Magento Community
Magento Community
Magento Community
 
kulturshock
Jr. Member
 
Total Posts:  29
Joined:  2009-11-30
 

The simple answer is NO. Just because you use a PCI compliant merchant does not make you compliant. Of course NOT using a PCI compliant merchant means that you are not compliant.

You may well be compliant, so long as you can prove it, answer the questioanaire, and have good policies and procedures.

 
Magento Community Magento Community
Magento Community
Magento Community
 
Turnkeye
Enthusiast
 
Avatar
Total Posts:  908
Joined:  2008-12-20
URL: turnkeye.com
 

According to https://www.pcisecuritystandards.org/pdfs/pci_pa-dss_program_guide.pdf

* PA-DSS does NOT apply to a payment application developed for and sold to only one customer
since this application will be covered as part of the customer’s normal PCI DSS compliance review.
Note that such an application (which may be referred to as a “bespoke” application) is sold to only
one customer (usually a large merchant or service provider), and it is designed and developed
according to customer-provided specifications.

* PA-DSS does NOT apply to payment applications developed by merchants and service providers if
used only in-house (not sold, distributed, or licensed to a third party), since this in-house developed
payment application would be covered as part of the merchant’s or service provider’s normal PCI
DSS compliance.

Rather Interesting to read it.

 
Magento Community Magento Community
Magento Community
Magento Community
 
Moosejaw
Jr. Member
 
Total Posts:  1
Joined:  2010-03-24
 

The thing is here, we cannot actually be sure as to whether this information is genuine? More info please.

 
Magento Community Magento Community
Magento Community
Magento Community
 
TWDesign
Member
 
Total Posts:  38
Joined:  2009-10-31
 
Turnkeye.com - 09 March 2010 11:34 AM

According to https://www.pcisecuritystandards.org/pdfs/pci_pa-dss_program_guide.pdf

* PA-DSS does NOT apply to a payment application developed for and sold to only one customer
since this application will be covered as part of the customer’s normal PCI DSS compliance review.
Note that such an application (which may be referred to as a “bespoke” application) is sold to only
one customer (usually a large merchant or service provider), and it is designed and developed
according to customer-provided specifications.

* PA-DSS does NOT apply to payment applications developed by merchants and service providers if
used only in-house (not sold, distributed, or licensed to a third party), since this in-house developed
payment application would be covered as part of the merchant’s or service provider’s normal PCI
DSS compliance.

Rather Interesting to read it.

I don’t think this covers the use of Magento Community Edition though, which is what most people
hear are concerned about. Or if it DOES, it would automatically push the store owner concerned into
being a SAQ D type merchant (not a desirable situation).

Like it or not, the only viable path open for 99% of Magento Community Edition users after 1st July 2010
is to use PayPal Standard, Authorize.net, Google Checkout or some other outsourced card processor.

Clearly the major credit card companies DONT want mom and pop style websites going anywhere
near credit card information.

SIDENOTE: Even if you don’t have a website, even if all you own is an abacus and a card swiper, even if you
only process one credit card transaction a year, you need to read up on the PCI-DSS rules.

 
Magento Community Magento Community
Magento Community
Magento Community
 
sophiedevine
Jr. Member
 
Total Posts:  1
Joined:  2010-06-03
 

I am using PayPal as my payment method on my online store, does my site need to be pci compliant? I’ve heard it costs upwards of 2000.00 to become pci compliant on my end, even though I am only using PayPal....is this true?

 
Magento Community Magento Community
Magento Community
Magento Community
Magento Community
Magento Community
Back to top
Page 1 of 2