Difference between revisions of "ProDon:FAQ - PCI Standards"

From Logilys
Jump to: navigation, search
m
m (→‎Questions / Answers)
 
(9 intermediate revisions by 4 users not shown)
Line 1: Line 1:
 
{{Header_TOC}}<br>  
 
{{Header_TOC}}<br>  
 +
<span style="color: rgb(255, 0, 0);">'''*** THIS DOCUMENTATION APPLIES TO THE SOFTWARE PRODON AND PROLOC ***'''</span>
 +
== Introduction  ==
  
−
== Introduction  ==
+
Here are some frequently asked questions about the PCI standard, which we invite you to read.
 +
 
 +
For any questions regarding the PCI DSS standard, please contact VikingCloud by email at [mailto:support@pcidssportalna.com. support@pcidssportalna.com.]
 +
 
 +
If you have any further questions, please contact us at 1-855-564-4597 or file a support request.
 +
 
 +
<br>
 +
 
 +
'''Temporary Notice:'''
  
−
Here are a few frequently asked questions concerning the PCI requirements.  
+
A new version of the PCI-DSS standard (4.0) has just been adopted. This new version requires a vulnerability scan of your websites. You must submit the site where the transaction takes place, either: [http://www.JeDonneEnligne.com www.JeDonneEnligne.com] and/or [http://www.JeMinscrisMaintenant.com www.JeMinscrisMaintenant.com]. The new standard includes a significant number of vulnerabilities to be addressed, which we are currently working to comply with. If you receive a failed compliance report, please send a copy to: [mailto:Securite@logilys.com securite@logilys.com]. No individual follow-up will be conducted upon receipt of the report, but we will verify that the failures correspond to those already known and will be corrected shortly.
  
−
We invite you to read them, for further questions, please contact us at 1-855-564-4597 or file a support request.  
+
A notice will be sent to our clientele as soon as known vulnerabilities have been addressed, and you may then request a new scan of [http://www.JeDonneEnligne.com www.JeDonneEnligne.com] and/or [http://www.JeMinscrisMaintenant.com www.JeMinscrisMaintenant.com].
  
−
<br>
+
If the report still fails at this point, please send a copy to [mailto:Securite@logilys.com securite@logilys.com] and follow-up will be conducted.<div style="left: 689.283px; top: 92.8px; display: none;" id="skype_c2c_menu_container" class="skype_c2c_menu_container"><div class="skype_c2c_menu_click2call">[[Skype: 18197580560?call&origin=FFTB/SPNR/7.1.15383.6004/http://update wikien.logilys.com/extensions/FCKeditor/fckeditor/editor/fckeditor.html|Call]]</div><div class="skype_c2c_menu_click2sms">[[Skype: 18197580560?sms&origin=FFTB/SPNR/7.1.15383.6004/http://update wikien.logilys.com/extensions/FCKeditor/fckeditor/editor/fckeditor.html|Send SMS]]</div><div class="skype_c2c_menu_add2skype">[[Skype: 18197580560?add&origin=FFTB/SPNR/7.1.15383.6004/http://update wikien.logilys.com/extensions/FCKeditor/fckeditor/editor/fckeditor.html|Add to Skype]]</div><div class="skype_c2c_menu_toll_info"><span class="skype_c2c_menu_toll_callcredit">You'll need Skype Credit</span><span class="skype_c2c_menu_toll_free">Free via Skype</span></div></div>  
−
<div style="left: 689.283px; top: 92.8px; display: none;" id="skype_c2c_menu_container" class="skype_c2c_menu_container"><div class="skype_c2c_menu_click2call">[[Skype: 18197580560?call&origin=FFTB/SPNR/7.1.15383.6004/http://update wikien.logilys.com/extensions/FCKeditor/fckeditor/editor/fckeditor.html|Call]]</div><div class="skype_c2c_menu_click2sms">[[Skype: 18197580560?sms&origin=FFTB/SPNR/7.1.15383.6004/http://update wikien.logilys.com/extensions/FCKeditor/fckeditor/editor/fckeditor.html|Send SMS]]</div><div class="skype_c2c_menu_add2skype">[[Skype: 18197580560?add&origin=FFTB/SPNR/7.1.15383.6004/http://update wikien.logilys.com/extensions/FCKeditor/fckeditor/editor/fckeditor.html|Add to Skype]]</div><div class="skype_c2c_menu_toll_info"><span class="skype_c2c_menu_toll_callcredit">You'll need Skype Credit</span><span class="skype_c2c_menu_toll_free">Free via Skype</span></div></div>  
 
 
== Questions / Answers  ==
 
== Questions / Answers  ==
  
−
Q. What are the PCI standards?<br>A. PCI stands for ''Payment Card Industry''.Those are the security regulations related to the data manipulation of the transactions made with credit cards, in order to prevent fraud.<br> <br>Q. Do we have to comply with the PCI standards if we have a merchant account with ''Netbanx (PaySafe)''?  
+
Q. What is the PCI standard?<br>A. PCI stands for ''Payment Card Industry.'' These are security regulations for handling credit card transaction data, established to prevent fraud.<br> <br>Q. Do we have to comply with the PCI standard if we have a merchant account with ''Netbanx (PaySafe)''?  
  
−
A. Yes, you do. Any merchant who accepts transactions (donations or payments) by credit cards must comply with the PCI standards.  
+
A. Yes. Any merchant accepting credit card transactions (donations or payments) must comply with the PCI standard.  
  
 
<br>  
 
<br>  
  
−
Q. We only have the Online Donation Module (''IMakeAnOnlineDonation''), therefore we do not deal with any credit card number (Web account). Do we still have to comply with the PCI standards?  
+
Q. We only have the online donation module (''IMakeAnOnlineDonation''), so we do not handle any credit card numbers (web account). Do we still have to comply with the PCI standard?  
  
−
A. Yes, you do. You must still comply with the PCI standards, but the form is easier to complete. It is the "SAQ A" form.  
+
A. Yes. You still must comply with the PCI standard, but the form to be completed in this case is very simple: the "SAQ A" form.  
  
 
<br>  
 
<br>  
  
−
Q. Is it normal to be asked to complete the "SAQ C" form?&nbsp;  
+
Q. Is it normal to be asked to fill out the "SAQ C" form?&nbsp;  
  
−
A. Yes, it is. Since you accept phone or mail donations (reply coupon), you see and handle credit card numbers. The "SAQ C" form is a little more complete than the one mentioned in the previous question. The aim is to ensure ''PaySafe'' that your methods are secure when it comes to handling the credit card data to be entered in the virtual terminal.&nbsp;  
+
A. Yes, if you accept donations by telephone or mail (reply coupons), because you see and handle credit card numbers. The "SAQ C" form is a little more complete than the "SAQ A" form. It is designed to assure ''PaySafe'' that your methods are secure when you handle credit card data and enter it into the virtual terminal.&nbsp;  
  
 
<br>  
 
<br>  
  
−
Q. Is it normal to be asked to complete the "SAQ D" form?  
+
Q. Is it normal to be asked to fill out the "SAQ D" form?  
  
−
A. Only if you keep credit card numbers electronically (e.g. by email or in an ''Excel ''spreadsheet). However, this method is to be avoided because it exposes you to great risks of fraud and implies major security constraints.&nbsp; It is the most complex form to complete.  
+
A. Only if you store credit card numbers electronically (e.g. by email or in an ''Excel'' spreadsheet). This method should be avoided, as it exposes you to great risks of fraud and involves major security constraints. The "SAQ D" form is the most complex to fill.  
  
 
<br>  
 
<br>  
  
−
Q. We have a ''PaySafe'' account as well as the Online Donation Module (''IMakeAnOnlineDonation''). Are the credit card data saved on your website?  
+
Q. We have a ''PaySafe'' account and the online donation module (''IMakeAnOnlineDonation''); are credit card numbers stored on your site?  
  
−
A. No, they are not. The payment data are kept in a secure vault at ''Netbanx'' and cannot be recovered, neither by you, nor by ''IMakeAnOnlineDonation''.
+
A. No. Payment data is stored in a secure vault at ''Netbanx'' and cannot be retrieved by you or ''IMakeAnOnlineDonation..''  
  
 
<br>  
 
<br>  
  
−
Q. We have a ''PaySafe'' account as well as the Electronic Transactions Module (virtual terminal). Are the credit card data saved in ''ProDon''?  
+
Q. We have a ''PaySafe'' account and the electronic transaction module (virtual terminal); are credit card numbers stored in ''ProDon''?  
  
−
A. No, they are not. The payment data are kept in a secure vault at ''Netbanx'' and cannot be recovered, neither by you, nor by ''ProDon''.
+
A. No. Payment data is stored in a secure vault at ''Netbanx'' and cannot be retrieved by you or ''ProDon.''  
  
 
<br>  
 
<br>  
  
−
Q. Can Logilys assist me to fill out the "SAQ A" or "SAQ C" PCI form?  
+
Q. Can Logilys help me fill out the PCI "SAQ A" or "SAQ C" form?  
  
−
A. Only for the&nbsp; "LIST ALL THIRD PARTY SERVICE PROVIDERS (Leave blank if not applicable)" section. Here is the information you need to enter:  
+
A. Only for the section "LIST ALL THIRD PARTY SERVICE PROVIDERS (Leave blank if not applicable)". Here is what you need to enter:  
  
 
*Payment Gateway: "''Netbanx-PaySafe''"  
 
*Payment Gateway: "''Netbanx-PaySafe''"  
Line 58: Line 67:
 
*Co-Location: N/A
 
*Co-Location: N/A
  
−
All the other questions on those questionnaires are related to the IT security implemented in your organization and on the workstations hosting ''ProDon''. Since we do not know this environment and do not have any expertise with the PCI standards, we are not able to assist you any further.
+
All the other questions on these questionnaires concern the IT security systems installed in your establishment and on the workstations hosting ''ProDon''. Since we don't know this environment, nor do we have the expertise in the PCI standard, we are not able to assist you
  
−
However, feel free to contact us with any questions related to ''IMakeAnOnlineDonation ''or ''ProDon''. <br>  
+
However, please do not hesitate to contact us if you have any questions about ''IMakeAnOnlineDonation'' or ''ProDon.'' <br>  
  
 
<br>  
 
<br>  
Line 67: Line 76:
  
 
A. ''Security Metrics'' is a certified firm, specializing in the management of all aspects related to the PCI standards compliance, recommended by ''PaySafe''. This firm has the expertise required to assist you with the completion of the "SAQ A" or "SAQ C" form. For any questions about these forms, you can contact a support technician at 1-801-995-6403.<br>  
 
A. ''Security Metrics'' is a certified firm, specializing in the management of all aspects related to the PCI standards compliance, recommended by ''PaySafe''. This firm has the expertise required to assist you with the completion of the "SAQ A" or "SAQ C" form. For any questions about these forms, you can contact a support technician at 1-801-995-6403.<br>  
 +
 +
Q: We are asked to provide URL addresses for a security scan, what should we submit?
 +
 +
A: It is recommended to submit [http://www.JeDonneEnligne.com www.JeDonneEnligne.com] and/or [http://www.JeMinscrisMaintenant.com www.JeMinscrisMaintenant.com].
  
 
<br>  
 
<br>  
  
−
Q. Do we need an IT technician to complete the forms?  
+
Q. Do we need an IT technician to fill in the forms?  
  
−
A. Certain questions are very technical and require an excellent understanding of your IT&nbsp;environment and networking; consequently it is very likely that you will need the help of your IT technician.  
+
A. Some questions are highly technical and require an excellent understanding of your IT and networking environment. It is very likely that you will need the help of your technician.  
  
 
<br>  
 
<br>  
  
−
Q. We have failed the PCI certification. What should we do?  
+
Q. We have failed PCI certification, what should we do?  
  
−
A. The security regulations that failed are clearly identified in the compliance report. You must check these points with your technician to rectify the situation.  
+
A. Failed safety rules are clearly identified in the compliance report. You must check each of these points with your technician to rectify the situation.  
  
 
<br>  
 
<br>  
  
 
{{Footer_Common_Functions}}<br>
 
{{Footer_Common_Functions}}<br>

Latest revision as of 08:49, 3 May 2024

FAQ - PCI Standards

*** THIS DOCUMENTATION APPLIES TO THE SOFTWARE PRODON AND PROLOC ***

Introduction

Here are some frequently asked questions about the PCI standard, which we invite you to read.

For any questions regarding the PCI DSS standard, please contact VikingCloud by email at support@pcidssportalna.com.

If you have any further questions, please contact us at 1-855-564-4597 or file a support request.


Temporary Notice:

A new version of the PCI-DSS standard (4.0) has just been adopted. This new version requires a vulnerability scan of your websites. You must submit the site where the transaction takes place, either: www.JeDonneEnligne.com and/or www.JeMinscrisMaintenant.com. The new standard includes a significant number of vulnerabilities to be addressed, which we are currently working to comply with. If you receive a failed compliance report, please send a copy to: securite@logilys.com. No individual follow-up will be conducted upon receipt of the report, but we will verify that the failures correspond to those already known and will be corrected shortly.

A notice will be sent to our clientele as soon as known vulnerabilities have been addressed, and you may then request a new scan of www.JeDonneEnligne.com and/or www.JeMinscrisMaintenant.com.

If the report still fails at this point, please send a copy to securite@logilys.com and follow-up will be conducted.

Questions / Answers

Q. What is the PCI standard?
A. PCI stands for Payment Card Industry. These are security regulations for handling credit card transaction data, established to prevent fraud.

Q. Do we have to comply with the PCI standard if we have a merchant account with Netbanx (PaySafe)?

A. Yes. Any merchant accepting credit card transactions (donations or payments) must comply with the PCI standard.


Q. We only have the online donation module (IMakeAnOnlineDonation), so we do not handle any credit card numbers (web account). Do we still have to comply with the PCI standard?

A. Yes. You still must comply with the PCI standard, but the form to be completed in this case is very simple: the "SAQ A" form.


Q. Is it normal to be asked to fill out the "SAQ C" form? 

A. Yes, if you accept donations by telephone or mail (reply coupons), because you see and handle credit card numbers. The "SAQ C" form is a little more complete than the "SAQ A" form. It is designed to assure PaySafe that your methods are secure when you handle credit card data and enter it into the virtual terminal. 


Q. Is it normal to be asked to fill out the "SAQ D" form?

A. Only if you store credit card numbers electronically (e.g. by email or in an Excel spreadsheet). This method should be avoided, as it exposes you to great risks of fraud and involves major security constraints. The "SAQ D" form is the most complex to fill.


Q. We have a PaySafe account and the online donation module (IMakeAnOnlineDonation); are credit card numbers stored on your site?

A. No. Payment data is stored in a secure vault at Netbanx and cannot be retrieved by you or IMakeAnOnlineDonation..


Q. We have a PaySafe account and the electronic transaction module (virtual terminal); are credit card numbers stored in ProDon?

A. No. Payment data is stored in a secure vault at Netbanx and cannot be retrieved by you or ProDon.


Q. Can Logilys help me fill out the PCI "SAQ A" or "SAQ C" form?

A. Only for the section "LIST ALL THIRD PARTY SERVICE PROVIDERS (Leave blank if not applicable)". Here is what you need to enter:

  • Payment Gateway: "Netbanx-PaySafe"
  • Point-of-Sale Terminal: N/A
  • Web Host: You must enter the name of your organization's website host
  • Payment Application: N/A
  • Shopping Cart: "IMakeAnOnlineDonation - Logilys"
  • Co-Location: N/A

All the other questions on these questionnaires concern the IT security systems installed in your establishment and on the workstations hosting ProDon. Since we don't know this environment, nor do we have the expertise in the PCI standard, we are not able to assist you

However, please do not hesitate to contact us if you have any questions about IMakeAnOnlineDonation or ProDon.


Q. Who is Security Metrics?

A. Security Metrics is a certified firm, specializing in the management of all aspects related to the PCI standards compliance, recommended by PaySafe. This firm has the expertise required to assist you with the completion of the "SAQ A" or "SAQ C" form. For any questions about these forms, you can contact a support technician at 1-801-995-6403.

Q: We are asked to provide URL addresses for a security scan, what should we submit?

A: It is recommended to submit www.JeDonneEnligne.com and/or www.JeMinscrisMaintenant.com.


Q. Do we need an IT technician to fill in the forms?

A. Some questions are highly technical and require an excellent understanding of your IT and networking environment. It is very likely that you will need the help of your technician.


Q. We have failed PCI certification, what should we do?

A. Failed safety rules are clearly identified in the compliance report. You must check each of these points with your technician to rectify the situation.


Document name: ProDon:FAQ - PCI Standards


Retrieved from "http://wikien.logilys.com/index.php?title=ProDon:FAQ_-_PCI_Standards&oldid=10239"