Discovering Visa’s security requirements

Due to a change my company is making in credit card processing companies, the bank that we use has declined on signing off on the change until we meet Visa’s current security requirements. Our current credit-card processing volume hasn’t been much so we are trying to figure out how much meeting these requirements will cost us and if it will be worth the cost. Any suggestions? Via the Internet.

Due to a change my company is making in credit card processing companies, the bank that we use has declined on signing off on the change until we meet Visa’s current security requirements. Our current credit-card processing volume hasn’t been much so we are trying to figure out how much meeting these requirements will cost us and if it will be worth the cost. Any suggestions?

Via the Internet.

To an extent, the bank handling your merchant account is in the driver’s seat. For Visa to OK the change you are submitting, there are certain requirements that must be met. Look at the documents – available from Visa’s security Web site – that your bank should have provided to you. For lower level processing volumes, the requirements aren’t too bad. Most of what they are looking for should be a part of your network security procedures.

One thing that may be optional, depending on the volume of transactions, is a periodic scan of your network by a certified third party testing vendor approved by Visa. The more conservative your bank, the more likely they are to require that this be done, even though Visa itself doesn’t require it.

Check several different testing service providers to see what their price range is for services rendered and what you get for that money. If your bank “requires” that you use a certain testing company, ask why, because there is no requirement from Visa that I could find.

Even though you may have ot use a third-party testing company, I would do your own testing using something like NMAP, GFI’s Network Security Scanner or Nessus. I would test both inside and outside your network. This helps keep the testing vendor on their toes as you have something to compare its results with and question them if you don’t see the same results.