Essentials

Any application involved in the transmission, storage, or processing of credit card information is in scope for PCI compliance. Additionally, if this application is sold to third parties and is involved in the authorization or settlement of cardholder information, it must be PA-DSS certified. A PCI Report on Validation (RoV) will validate this type of payment application with the various PA-DSS control requirements. PA-DSS Requirements are below:

• Do not retain full magnetic stripe, card validation code or value
• Protect stored cardholder data
• Provide secure authentication features
• Log payment application activity
• Develop secure payment applications
• Protect wireless transmissions
• Test payment applications to address vulnerabilities
• Facilitate secure network implementation
• Cardholder data must never be stored on a server connected to the Internet
• Facilitate secure remote access to payment application
• Encrypt sensitive traffic over public networks
• Encrypt all non-console administrative access
• Maintain instructional documentation and training programs for customers, resellers, and integrators

As of 7/1/2010, Visa requires acquirers to ensure their merchant, VNPs (Visa Net Processors), and agents use only PABP or PA-DSS compliant payment applications. Effective July 1, 2012, MasterCard will require that all merchants and service providers utilizing third party payment applications ensure that the application is PA-DSS certified. Based on SecureState’s experience, very few payment applications are fully compliant with PCI PA-DSS the first time through.

Benefits

• Validation of compliance with the PA DSS
• Competitive edge when marketing applications to merchants
• Verification that payment applications can be configured to meet PCI DSS compliance requirement

Expertise

SecureState’s Audit & Compliance consultants are experts in understanding both the technical aspects as well as the business aspects of payment applications. As a QSA and PA QSA company, SecureState understands the full payment lifecycle from the application level to implementation within a merchant’s cardholder data environment.