PCI Compliance

In late 2004, Visa and MasterCard announced a new security initiative known as the Payment Card Industry (PCI) Data Security Standard in an effort to standardize industry security requirements for storing, processing and transmitting cardholder data. This new standard combines and expands on Visa's Cardholder Information Security Program (CISP) and MasterCard's Site Data Protection (SDP) Program.

As with CISP and SDP, the credit card associations require merchants and applicable service providers to comply with the PCI Data Security Standard. As an e-onlinedata merchant, you should be aware that requirements and deadlines for PCI compliance vary depending on the number of transactions you processes annually.

For example, if you process more than 20,000 eCommerce transactions per year, you must do the following to achieve PCI compliance:

• Complete an annual self-assessment questionnaire
• Complete a quarterly network scan conducted by a qualified independent scan vendor such as AmbironTrustWave

Initial Deadline: June 30, 2005

If you process fewer than 20,000 e-commerce transactions per year, it is recommended* that you:

• Complete an annual self-assessment questionnaire
• Complete an annual network scan conducted by a qualified independent scan vendor such as AmbironTrustWave
  

Initial Deadline: None

To assist our customers in achieving and maintaining PCI compliance, we offer the services of AmbironTrustWave, a leading data security and compliance services provider that offers convenient and affordable PCI compliance tools. AmbironTrustWave is offering its compliance services, which include network scans and assistance with self assessments.

For more information about PCI merchant levels and compliance requirements, please visit http://www.pcicomplianceguide.org/.