National Merchant Bancard, what are the scanning?

[maitaijim]

Not having any direct relationship with the client may sound like a blessing but it has it's down side also. Communicating through the designers (read hippie artists) can sometimes lead to some strange info coming from the client.

I was told "the visa people" needed to do a security scan of the store before they would transfer funds to their checking account. They also said that the links from the homepage to the store need to point at the actually store for the scan. Zen Cart was in a sub directory and the homepage links were pointing to a store coming soon page.

Does National Merchant Bancard perform a security scan and do they actually require any links referring to the store be "live" at the time of the scan. If there is a scan does anyone here know what the criteria is for passing?

The designers never heard anything more about it so I assume it's all squared away.

Thanks,
Jim

[Kim]

Suggest you Google - PCI Compliance.

[maitaijim]

Suggest you Google - PCI Compliance.

I'm very familiar with PCI DSS, implementing design into Zen Cart has some how gotten me twisted up in the evil world of full time web development. PCI Compliance is why we recommend Zen Cart and Certified Hosts to all of our ecom clients. I asked if it was for PCI Compliance and was told it wasn't. Can't say I understand why the links were required to be "live,

Jim

[DrByte]

I suspect that the card processor's underwriters will want to see his website to make sure that his website is consistent with his registered business type before approving the account application.
And I suspect that in order to make that determination the store would need to be accessible.
I don't see why that would be an unreasonable request ...

[maitaijim]

I was coming at this from a purely curious perspective, no judgment of reason was meant. The store was always accessible at "/shop" and I am just looking to be prepared next time if having a link from the homepage is a requirement for getting the green light from the merchant account.

I will call NMB again to see if I can get a straighter answer to what their criteria is for green lighting a site. Seems like good info to have publicly available, us developers sometimes don't have any say in where the client is hosted. It would be nice to know at the beginning of a job if a host/install meets their basic requirements.


Jim

[maitaijim]

I was just informed by a very nice woman at National Merchant Bancard that only the shopping cart portion of the store is scanned and the rest of the sight must be lawful. The only other item mentioned was the obvious need of an SSL. The rest of the criteria relates to the security aspects of the host's servers which shouldn't be a problem with a reputable hosting company. This information only applies to SAQ Validation Type 1 which under the current rules describes the use of the Authorize.net payment module.

To get back to my original inquiry, no request would have come from NMB to change the links on the homepage to point at the actual shopping cart.

Jim

[maitaijim]

and the rest of the sight must be lawful.

hmmm maybe I am going mentally blind
Should have been, and the rest of the site must be lawful.
This is what learning PHP is doing to me brains.
Jim