Wine Technology Blog @ WineWeb.com

We just finished our annual PCI Data Security Standards asssessment and have made sure that we are still in compliance for accepting and storing credit card data. Luckily, having done over 70 computer control audits in what feels like another lifetime, this process was relatively easy, although the 200 questions did take some time to answer and verify with our policies and procedures.

While previously there was an exemption for small companies, now every merchant that accepts credit cards must complete an annual assessment in order to be compliant with this requirement (www.pcisecuritystandards.org for more info). If you use an e-commerce service like ours (WineWeb), then the process is simpler with about 30 questions in the assessment. However, if your company has it's own shopping cart software running on a web server and you store credit card data electronically, then you're into the long questionnaire, which requires things like an "Encryption Key Custodian Acknowledgement" and an "Incident Response Plan". You've got those, right?