Answers.Body: <p>I have had experience with AuthorizeNet and PCI compliance both with CiviCRM installs and other sites with custom configurations. the process is the same, generally the merchant account provider will require scans through a service provider. You will most likely need to make adjustments to server settings, primarily port/firewall adjustments. Depending on your hosting provider the ease of this may vary. Shared hosting may cause some issues as they may not make the changes.</p>
  
  <p>Keep in mind that PCI compliance goes beyond your website transactions. If you process any Credit Card information from your office network via the AuthorizeNet Portal or a swipe machine your office network will be scanned and some adjustments may need to be made there also. </p>
  
  <p>The process involves filing out a questionnaire and scans. Also most providers require regular scans to maintain compliance. It's important to maintain compliance as most merchants account providers will charge higher fees if you are not compliant.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-11-16T21:11:29.247Z
Answers.LastActivityDate: 2016-11-16T21:11:29.247Z
Answers.UserDisplayName: KilakwaBT
Answers.Body: <p>A great explanation of PCI compliance and things an organization should consider relating to PCI compliance is available from this CiviCon Denver 2015 talk: <a href="https://www.youtube.com/watch?v=0TSPiYH2AS8" rel="nofollow noreferrer">CiviCon Denver Data Security and Payment</a>.  See my answer here for other relevant info: <a href="https://civicrm.stackexchange.com/a/10453/105">https://civicrm.stackexchange.com/a/10453/105</a></p>
  
  <p>We also use Drupal 7 and Civi 4.6, but are hosted on MediaTemple and use iATS for our payment processor.  The biggest issue will be whether you take payment directly onsite or offsite (I'm not familiar with Authorize.net).  In and of itself, a MediaTemple VPS is not PCI compliant.  We had to take steps ourselves to make sure our server met the PCI criteria.  iATS has their clients enroll in PCI Smart which is a PCI compliance testing and reporting program through TrustWave. We used those scans as guidance for what we needed to adjust technically on the server to meet PCI guidelines and the self-report to determine in-house processes to meet the PCI criteria.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-11-16T19:51:46.407Z
Answers.LastActivityDate: 2016-11-16T19:51:46.407Z
Answers.LastEditDate: 2017-04-13T12:53:13.017Z
Answers.UserDisplayName: Allen Hutchison
Body: <p>I want to preface this by saying that I am aware that no one here can tell me authoritatively whether I am PCI compliant, since only licensed people can do that. </p>
  
  <p>Instead, I'm asking what your experience was in seeking out compliance. My site is run on Drupal 7, CiviCRM 4.6, and we use Authorize.net for our payment processor. We have SSL. Do you have any helpful intel on how hard or easy this will be for us?</p>
  
  <p>edited to add: We are hosted by CiviHosting</p>
  
Tags: <drupal><4.6><authorize.net><pci-compliance>
Title: How hard is it to obtain PCI compliance?
ThreadText: # How hard is it to obtain PCI compliance?
  
  (Asked by: username_0 on 2016-11-16)
  
  I want to preface this by saying that I am aware that no one here can tell me authoritatively whether I am PCI compliant, since only licensed people can do that.
  
  Instead, I'm asking what your experience was in seeking out compliance. My site is run on Drupal 7, CiviCRM 4.6, and we use Authorize.net for our payment processor. We have SSL. Do you have any helpful intel on how hard or easy this will be for us?
  
  edited to add: We are hosted by CiviHosting
  
  **Tags:** drupal, 4.6, authorize.net, pci-compliance
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2016-11-16. Score: 3 | Accepted answer
  
  A great explanation of PCI compliance and things an organization should consider relating to PCI compliance is available from this CiviCon Denver 2015 talk: [CiviCon Denver Data Security and Payment](https://www.youtube.com/watch?v=0TSPiYH2AS8). See my answer here for other relevant info: <https://civicrm.stackexchange.com/a/10453/105>
  
  We also use Drupal 7 and Civi 4.6, but are hosted on MediaTemple and use iATS for our payment processor. The biggest issue will be whether you take payment directly onsite or offsite (I'm not familiar with Authorize.net). In and of itself, a MediaTemple VPS is not PCI compliant. We had to take steps ourselves to make sure our server met the PCI criteria. iATS has their clients enroll in PCI Smart which is a PCI compliance testing and reporting program through TrustWave. We used those scans as guidance for what we needed to adjust technically on the server to meet PCI guidelines and the self-report to determine in-house processes to meet the PCI criteria.
  
  
  ---
  
  ### Answer by username_1 on 2016-11-16. Score: 3
  
  I have had experience with AuthorizeNet and PCI compliance both with CiviCRM installs and other sites with custom configurations. the process is the same, generally the merchant account provider will require scans through a service provider. You will most likely need to make adjustments to server settings, primarily port/firewall adjustments. Depending on your hosting provider the ease of this may vary. Shared hosting may cause some issues as they may not make the changes.
  
  Keep in mind that PCI compliance goes beyond your website transactions. If you process any Credit Card information from your office network via the AuthorizeNet Portal or a swipe machine your office network will be scanned and some adjustments may need to be made there also.
  
  The process involves filing out a questionnaire and scans. Also most providers require regular scans to maintain compliance. It's important to maintain compliance as most merchants account providers will charge higher fees if you are not compliant.
  
  
  ---
  
  