<div>
Since your client already accepts credit cards, do they have a vendor that scans their system every quarter or year? &nbsp;Some merchant account providers actually charge the merchant a fee each month. &nbsp;If so, you might see about contacting them.<br />
<br />
<a href="https://www.pcisecuritystandards.org/security_standards/documents.php?agreements=pcidss&assocation=PCI%20DSS" rel="ugc">PCI DSS Documents</a>. &nbsp;It sounds like you might be working on a wireless solution. &nbsp;Besides reading PCI DSS v2.0, check out the Wireless Guideliness and Overview of the PCI DSS Wireless Guideline.<br />
<br />
There are a number of things that should be done though. &nbsp;You provided a few things, but left out some things. &nbsp;For example, how are they obtaining this data at the remoate stations? &nbsp;If they are keying in the entry, do you store the Primary Account Number (PAN)? &nbsp;If so, do you do this because the customer might want a refund? &nbsp;What numbers of the PAN do you show - the max you can show is the first 6 and the last 4 - all other numbers should be masked. &nbsp;And you should not store the <a href="http://www.mymerchantaccountblog.com/2010/01/card-verification-value---card-verification-code---card-identification-number" rel="ugc">Card Verification Value - Card Verification Code - Card Identification Number</a>. <br />
<br />
Go through each of those requirements on PCI DSS 2 to make sure everything is covered. &nbsp;Take a look at the documents in PCI DSS New Self-Assessment Questionnaire (SAQ) to see if everything on that list can be covered as well (the merchant should complete this as well).
</div>


<div>
Thanks for the info.<br />
<br />
To clarify, the company tends to do a lot of business at trade shows, and they want to capture that data and charge on the spot while they've got the customer there. &nbsp;The site they're entering the data into stores the PAN in an encrypted database, and none of the users has rights to read the full PAN (last 4 digts are displayed to provide additioanl means to confirm identity when the doctors call in to customer service). &nbsp;The payment processing is done through an API on the site that polls the database and charges the customer for products. &nbsp;The company deals with doctors and usually processes several hundred transactions per doctor per month, so as a matter of convenience they store the PAN and customer info to automate the purchase process as much as possible.<br />
<br />
The HQ network stores all of the servers behind a firewall, and most of the internal network appears to be compliant, although I haven't had the chance to run a full-on audit yet. &nbsp;The first question I have to answer for them concerns the ability to enter and process payments remotely. &nbsp;My thought was to provide a laptop that they can take with them to trade shows, and also set up the RSA system with their firewall to provide 2 layer authentication (RSA to secure the VPN tunnel, and standard network login once the system has connected to the HQ network via VPN). &nbsp;The payment processing system aslo has another authentication step that is seperate from the network login. &nbsp;So at this point, my questions concern if this VPN tunnel approach would meet PCI compliance and if there are any concerns with authorizing charges to a remote system while traveling out of state.
</div>


<div>
To correct, there are no card swipes conducted at all in this environment. &nbsp;The card number and card holder information are entered into an intranet web portal, which houses an API provided by a third-party payment processor. &nbsp;At the moment, payment information is written down by hand on worksheets at the workshop and transferred back to their HQ in their luggage. &nbsp;This is not an acceptable solution.<br />
<br />
Getting these workshop sales guys on a VPN connection to the HQ facility would essentially extend the HQ environment to where they are with their laptop. &nbsp;From there, they would be required to log in to the Windows system, which will check their credentials against what is current in AD. &nbsp;Once they have been authenticated, they would then have to log in to the intranet web portal (which is currently synching with AD to get ID and password info) in order to enter and process any payments. &nbsp;Hopefully this arrangement makes sense.<br />
<br />
As long as this VPN/Windows session/Intranet session authentication method satisfies PCI DSS for remote processing of payment card data, then I think that should answer my question, I just wanted to make sure there weren't any hidden interpretations or auditor experience that would say otherwise.
</div>


<div>
<div class="content wysiwyg-content">
I am attempting to prepare a solution for a level 3 merchant that needs to have the ability to capture payment card data remotely at workshops. &nbsp;They are working on a web portal that will have a transaction service perform all of their payment processing. &nbsp;Basically, I am thinking about setting up their firewall to use RSA SecurID tokens to provide a second authentication layer to create a secure VPN tunnel into their network, which will allow them to access their internal payment processing portal. &nbsp;I just need to know if this will meet PCI DSS.<br />
<br />
Thanks,<br />
<br />
Chad
</div>
</div>


I am attempting to prepare a solution for a level 3 merchant that needs to have the ability to capture payment card data remotely at workshops.  They are working on a web portal that will have a transaction service perform all of their payment processing.  Basically, I am thinking about setting up their firewall to use RSA SecurID tokens to provide a second authentication layer to create a secure VPN tunnel into their network, which will allow them to access their internal payment processing portal.  I just need to know if this will meet PCI DSS.

Thanks,

Chad

PCI DSS: Charging via Web Portal

Electronic commerce (e-commerce) is the trading in products or services using computer networks, such as the Internet. E-commerce draws on technologies such as mobile commerce, electronic funds transfer (EFT), supply chain management, online transaction processing, electronic data interchange (EDI), inventory management systems, and automated data collection systems. Use this topic to discuss online shopping carts, online marketplaces, and e-commerce platforms.