用于存储信用卡的 PCI 级别
我只是想知道如果您存储加密的信用卡号码以进行定期计费，PCI 认证级别会是多少。
不过，我计划每年的交易量少于 20,000 笔，但我不确定存储的信用卡号码。
I was just wondering what would be the PCI certification level if you were storing encrypted credit-card numbers for recurring billing.
I plan to have less than 20,000 transactions annually, however, with the storing credit card numbers I am not sure.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您确实（确实）需要存储卡号，那么您就属于 PCI 合规性的最严格级别。这需要每年进行现场审核、每季度进行网络扫描，并且（您可能已经意识到）成本将非常高昂。这与交易数量无关。 （PCI 的旧初稿根据处理的卡数量给出了不同的级别。现在情况已不再如此）
如果您可以使用第 3 方来存储/处理定期计费，那么您就会进入较低的级别，只需要您每年完成一份自我评估问卷 (SAQ)。如果您与大多数支付服务提供商讨论您的要求，他们将能够帮助您解决定期计费问题。定期计费（如您所知）具有额外的复杂性，因为卡可能会在周期中过期/停止/更换。
如果您有任何疑问，那么现在是开始与 QSA（合格安全评估员）交谈的最佳时机。如果您通过电话讨论您的情况，他们将能够准确地建议您的立场。最终，除非您选择第三方支付服务提供商，否则您将需要 QSA 来帮助您的组织遵守 PCI 合规性。
If you really (really) need to store card numbers, then you fall into the strictest level of PCI compliance. That requires annual on-site audits, quarterly network scans, and (as you may already be aware) will be very costly. This is regardless of number of transactions. (The old first drafts of PCI gave different levels depending on quantity of cards processed. That is no longer the case)
If you can use a 3rd party to store/process the recurring billing then you drop into a lower level which requires only that you complete a Self Assessment Questionnaire (SAQ) annually. Most payment service providers will be able to help with recurring billing if you discuss your requirements with them. Recurring billing (as you know) has extra complications in that cards can expire/be discontinued/replaced mid cycle
If you're at all in doubt, then now would be the best time to start speaking to QSA's (Qualified Security Assessor). If you discuss your situation over the phone they will be able to advise exactly where you stand. Ultimately, unless you go with a 3rd party Payment Service Provider you will need a QSA to assist with bringing your organisation into PCI compliance.