90 Minds Community

Hi All,
This is a request we got from a client about PCI compliance with DataSelf, which connects to Sage 100, which connects with Century Business Solutions credit card processing.

Have any of you encountered PCI DSS compliance questions to this level? I'm not sure how to respond. I've used the logic that we only connect to the ERP and the ERP doesn't contain any credit card information, end of story. But looks like this is "the rest of the story"...

----------Client Request ----------
Our Sage 100 uses Century Business Solutions to process credit cards ,(not Paya), and they are PCI compliant. Although I am required by the PCI Standards to make sure all access to the Sage server and all it's connections follow Policy and PCI-DSS compliant standards, below is a list of information I will need to verify compliance with this access we are granting to you.
Note: You are under PCI-DSS compliance when- You have access to a Computer or System that has Credit Card processing ability.

1. What transfer encryption is used to communicate with the Sage-Server integration?
2. Has your system been through a penetration test (PEN Test) ? When?  Result ?
3. What monitoring do you have to identify breaches with-in your system that could affect access to ours.
   What is your policy on informing us of a breach?
4. Have you ever had a PCI-DSS validation Scan done on the system that accesses our credit card computer?
5. What updates do you do to the DataSelf integration and are they automated or manually done by employees of DataSelf?
   What reporting policy do you have to notify us of any discovered vulnerabilities in the integration or one of it's updates.

1. Access to the same network as the Credit Card processor computer
2. Data transfer to or from the same network as the Credit Card processor computer
3. Have Integrations on the Credit Card processor computer.

Hi All,
This is a request we got from a client about PCI compliance with DataSelf, which connects to Sage 100, which connects with Century Business Solutions credit card processing.

Have any of you encountered PCI DSS compliance questions to this level? I'm not sure how to respond. I've used the logic that we only connect to the ERP and the ERP doesn't contain any credit card information, end of story. But looks like this is "the rest of the story"...

----------Client Request ----------
Our Sage 100 uses Century Business Solutions to process credit cards ,(not Paya), and they are PCI compliant. Although I am required by the PCI Standards to make sure all access to the Sage server and all it's connections follow Policy and PCI-DSS compliant standards, below is a list of information I will need to verify compliance with this access we are granting to you.
Note: You are under PCI-DSS compliance when- You have access to a Computer or System that has Credit Card processing ability.

1. What transfer encryption is used to communicate with the Sage-Server integration?
2. Has your system been through a penetration test (PEN Test) ? When?  Result ?
3. What monitoring do you have to identify breaches with-in your system that could affect access to ours.
   What is your policy on informing us of a breach?
4. Have you ever had a PCI-DSS validation Scan done on the system that accesses our credit card computer?
5. What updates do you do to the DataSelf integration and are they automated or manually done by employees of DataSelf?
   What reporting policy do you have to notify us of any discovered vulnerabilities in the integration or one of it's updates.

1. Access to the same network as the Credit Card processor computer
2. Data transfer to or from the same network as the Credit Card processor computer
3. Have Integrations on the Credit Card processor computer.