Managed PCI Compliant Hosting

PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. It applies to all entities that handle credit card transactions, such as merchants, processors, acquirers, issuers, and service providers, among others.

The newest version of PCI DSS was released on March 31st, 2022. The transition period from PCI DSS 3.2.1 is from March 31st, 2022 to March 31st 2024. Although some of PCI DSS v4 is effective immediately, the bulk of the 63 new requirements won’t be effective until March 31st, 2025.

There are 12 requirements for PCI DSS compliance that have been divided into 6 objectives:

1. Build and Maintain a Secure Network and Systems
   • Install and maintain a firewall configuration to protect cardholder data.
   • Do not use vendor-supplied defaults for system passwords and other security parameters.
2. Protect Cardholder Data
   • Protect stored cardholder data.
   • Encrypt transmission of cardholder data across open, public networks.
3. Maintain a Vulnerability Management Program
   • Protect all systems against malware and regularly update antivirus software or programs.
   • Develop and maintain secure systems and applications.
4. Implement Strong Access Control Measures
   • Restrict access to cardholder data by business need to know.
   • Identify and authenticate access to system components.
   • Restrict physical access to cardholder data.
5. Regularly Monitor and Test Networks
   • Track and monitor all access to network resources and cardholder data.
   • Regularly test security systems and processes.
6. Maintain an Information Security Policy
   • Maintain a policy that addresses information security for all personnel.

Non-compliance with PCI DSS can result in fines from credit card companies and banks. Where a breach occurs due to non-compliance the penalties may be more severe. Continued non-compliance may result in a loss of the ability to process credit card payments.

Yes, Storm provides fully-managed PCI compliance for Storm virtual and dedicated servers. For example, if you have a Storm cloud or dedicated server, we’ll run the PCI DSS external vulnerability scans on a quarterly basis. We’ll proactively address vulnerability and configuration issues to ensure that you are always PCI compliant.

If you process and potentially store credit card data, you are required to be PCI DSS compliant, regardless of the size of your business or the platform you are using.

However, the degree to which you are responsible for the security of the credit card data depends largely on how you handle that data. If you’re using a third-party payment processor like PayPal, Stripe, or Square to handle all the payment transactions, the burden of PCI compliance is significantly reduced. These services are PCI DSS compliant, and handle sensitive credit card information, which means it never touches your server.

While that could mean that you are not officially required to adhere to PCI DSS requirements, keep in mind that these requirements themselves are intended to significantly harden the security of a site, server, or even an entire network. As threats are continuously evolving, ensuring that your online assets and infrastructure are PCI DSS compliant will always work in your favour and deliver greater peace of mind.

Keep in mind that even if you are using a third-party processor, you still have some responsibilities. For instance, you need to ensure that your website is secure and that any potential access to the payment process is protected. This might include ensuring that your website uses HTTPS, that you keep your site’s core and any plugins (e.g. WooCommerce) up to date, and that you follow other cybersecurity best practices.

PCI DSS Requirement 11 states that both internal and external vulnerability scans should be conducted once every three months, with scans as close together as possible. The objective here is to ensure that vulnerabilities are identified and addressed in a timely manner.

However, it is encouraged that vulnerability scans are conducted more frequently when possible to have advanced warning of vulnerabilities and address these vulnerabilities accordingly. The PCI DSS considers once every three months (90 days) the maximum amount of time that can pass between scans. Where these scans cannot be performed at least every 90 days due to unforeseen circumstances, every effort should be made to conduct the vulnerability scans within a day or two of the 90-day window.

Keep in mind that PCI DSS also requires vulnerability scans whenever significant changes have been made to systems. In this case, the vulnerability scan should be performed in addition to the quarterly vulnerability scans.

Yes, clean vulnerability scans are required to be PCI compliant. PCI DSS requires that potential vulnerabilities indicated in scans be addressed, followed by another PCI vulnerability scan which should then indicate a pass.

While specific requirements for a “passing” scan can vary between dissimilar systems, such scans typically have the following characteristics:

• The scan does not detect software or configuration it considers a red flag (e.g. default system accounts created during the initial installation)
• The scan does not detect vulnerabilities at or above 4.0 on the Common Vulnerability Scoring System (CVSS
• Internal scans do not flag “critical” vulnerabilities as per PCI DSS Requirement 6

However, where new vulnerabilities arise while previously-identified vulnerabilities are being addressed, it could be sufficient to show that vulnerabilities are continuously being identified and addressed (even though a “passing” scan cannot be obtained).