Pro javascriptové platební brány, při kterých zákazník nemusí opustit eshop, je od ledna 2015 nutná složitější certifikace

Up until January 2015, if you were a Level 3 using a third party service you needed to fill out and comply with SAQ A. SAQ A consists basically of 13 questions, the sum of which boils down to “Is the data stored securely?”, and if your third party service is doing its job the answer is simply Yes.

Now the new standard introduces SAQ A-EP, this extends the assessment questionnaire and compliance requirements to 139 questions. Many of these new requirements will directly affect the way you can run your business and the level of overhead you will incur.

The worst offenders are the requirements that some businesses simply cannot comply with unless they have some serious cash laying around. Examples of this are

> Quarterly external vulnerability scans must be performed by an Approved Scanning Vendor (ASV), approved by the Payment Card Industry Security Standards Council (PCI SSC).

and

> Is external penetration testing performed per the defined methodology, at least annually, and after any significant infrastructure or application changes to the environment (such as an operating system upgrade, a sub-network added to the environment, or an added web server)?