Re: Is PCI Compliance Mandatory

["Jason Thompson" <securitux () gmail com>]

If any credit card data passes through your information systems, then
yes. For example I just did an app assessment for an organization that
had all their transactions processed by a CC processing vendor however
their web application took the CC data and forwarded it, therefore
they were under PCI DSS.

> From the PCI DSS 1.1:

PCI DSS requirements are applicable if a Primary Account Number (PAN)
is stored, processed, or
transmitted. If a PAN is not stored, processed, or transmitted, PCI
DSS requirements do not apply.

-J

On 12 Jan 2008 10:31:45 -0000,  <global.infosec () gmail com> wrote:
> Recently our organisation decided not to store credit card numbers in our databases of our retail outlets.
>
> Do we still need to comply to PCI DSS?