Yes
About PCI DSS Compliance Requirements. PCI DSS was created by the Payment Card Industry Security Standards Council, and is comprised of American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc. PCI DSS Standards. PCI DSS apply to merchants, manufacturers of PIN entry terminals, and the software used to store, process, and/or transmit cardholder data. PCI DSS: All merchants who store, process, and/or transmit cardholder data must comply with the standards. 318 1 4. IF you use somebody like shift4 for processing, authorization, etc., for example; then you have zero PCI requirements; basically, no card holder data (CHD), and Primary Account Number (PAN) means you do not have to be worry about PCI-DSS. If I ONLY save the last 4 digits of PAN,client name,expiry date and PRN, do I have to be PCI Compliant? If I have to, what about if I ONLY save the last 4 digits of PAN with PRN, do I have to be PCI Compliant? I read the PCI DSS documentation. The PCI DSS applies to any merchant or service provider that handles, processes, stores or transmits credit card data. Merchants. For merchants, the PCI Security Standards Council has provided on-your-honor compliance validation tools in the form of Self Assessment Questionnaires (SAQ's).  First, PCI compliance involves more than just your website. If your business takes credit card numbers over the phone, has face-to-face transactions, or keeps paper records that contain credit card numbers there are PCI requirements concerning that aspect of your business that has nothing to do with your website. Unless you have the ability to install your own security patches or have a written agreement with your web hosting provider that this requirement will be met, your server is not PCI compliant. An easy way to check is to see what version of PHP and what version of MySQL your server is running. Merchants do not have to choose the Program, but merchants must achieve and maintain PCI DSS compliance. Essentially merchants have three options: 1  Option 1: Through an alternative Qualified Security Assessor (QSA). 2  Option 2: Complete a Self-Assessment Questionnaire (SAQ) - non scanning merchants only. The Level 4 Merchant PCI DSS Program is included in the PCI Compliance Fee merchant pay monthly to Global Payments per merchant ID (with up to 3 quarterly IP scans-additional scans can be accommodated at $5 per additional scan). If you do not meet the PCI standards for compliance and the security of your site gets compromised, you will be facing penalties and fines ranging from $5,000 to $500,000. The fines, however, are just the beginning of the overall damage caused by noncompliance. Unless you have the ability to install your own security patches or have a written agreement with your web hosting provider that this requirement will be met, your server is not PCI compliant. An easy way to check is to see what version of PHP and what version of MySQL your server is running. But not everything is so obvious about PCI compliance, such as the question of whether or not your processing equipment has the latest PCI compliant software version. Now you do not have to wonder because all of that information can be found here on our website PCIfree.com. A small business can expect even a small scale data breach to cost $25,000 to $50,000 dollars in fines and legal fees. The Payment Card Industry Data Security Standard (PCI-DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment and prevent credit card fraud. Merchants that do not comply with PCI DSS may be subject to fines, card replacement costs, costly forensic audits, brand damage, etc., should a breach event occur. Many acquiring banks are issuing fines for merchants who do not comply with PCI. What I am doing is developing a financial software and connect it to a third party credit card company which is pci compliant. Our company is a Canadian company. We are not pci compliant and not planning to be pci compliant. But we want to save last 4 digits of PAN to help front line staff identify. If I ONLY save the last 4 digits of PAN,client name,expiry date and PRN, do I have to be PCI Compliant? If I have to, what about if I ONLY save the last 4 digits of PAN with PRN, do I have to be PCI Compliant? I read the PCI DSS documentation. The PCI SSC administers the program to validate payment applications’ compliance against the PA-DSS, and publishes and maintains a list of PA-DSS validated applications. See https://www.pcisecuritystandards.org/security_standards/pa_dss.shtml for more information. Q: What is the definition of ‘merchant’? A: For the purposes of the PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services.
http://www.pcifree.com/pci-dss.html http://stackoverflow.com/questions/8479747/do-i-have-to-be-pci-dss-compliant https://www.braintreepayments.com/blog/who-needs-to-be-pci-compliant/ http://www.mijireh.com/docs/what-you-need-to-know-about-pci-compliance/ https://www.globalpaymentsinc.com/us/customer-center/customer-support/pci-dss http://www.mijireh.com/docs/what-you-need-to-know-about-pci-compliance/ http://blog.pcifree.com/143/why-do-i-need-to-be-pci-compliant/ http://www.mypci.com/faq http://stackoverflow.com/questions/8479747/do-i-have-to-be-pci-dss-compliant https://www.pcicomplianceguide.org/pci-faqs-2/
do I have to have pci dss