Tell me more ×
Answers OnStartups is a question and answer site for entrepreneurs looking to start or run a new business. It's 100% free, no registration required.
up vote 3 down vote favorite

If one sells ecommerce software, do you HAVE to be PCI compliant at this point?

I read it costs upwards of 40K to get your ecomm software PCI compliant.

And some of the requirements have things like source code review, which means that your company is larger than 1.

Any thoughts on this?

I guess this industry is locked from 1-man operations?

share|improve this question

3 Answers

up vote 2 down vote

Per the document on PCI DSS first line is about software developed for off the shelf sales. The answer is yes.
https://www.pcisecuritystandards.org/pdfs/pci_pa_dss.pdf

http://en.wikipedia.org/wiki/PA-DSS

share|improve this answer
1  
well if you are selling/distributing your ecomm software product, I think you HAVE to be PCI compliant. – UnStartup Jul 21 '10 at 19:09
Good point. I don't know what I was thinking. – John Bogrand Jul 21 '10 at 19:20
Please note that the comments are refering to the first answer I provided which was incorrect. – John Bogrand Jul 22 '10 at 13:26
up vote 0 down vote

It's strongly recommended and sometimes needed. One key to becoming PCI compliant is not storing credit card numbers, something you want to avoid anyway.

share|improve this answer
@Dan, it seems many people (established ecomm soft) have yet to become compliant themselves. I'm just weary, being a 1-man operation and all... – UnStartup Jul 22 '10 at 0:59
up vote 0 down vote

I think you've to be PCI compliant only if you store credit card numbers, in other cases (if you let third party app to manage them) maybe you just want to run penetration test or code reviews just to be safe against crackers break-in.

Remember to check out Owasp material about how to write safe code. You can use also great ESAPI project from Owasp to embed security in you app with great library provided by security specialists. from all around the world.

However being PCI compliant is always a plus but maybe you want to reach the compliance by gentle migration.

Feel free to ask me more details about both penetration test than code reviews.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.