I'd recommend starting with the PCI DSS.  That standard is required by pretty much all card companies, and compliance is enforced by a self-assessment checklist and/or security assessor.  If you plan on storing card information, you must be in compliance with this standard.<p>PCI DSS Standard: <a href="https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml" rel="nofollow">https://www.pcisecuritystandards.org/security_standards/pci_...</a><p>More info on Wikipedia: <a href="http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard" rel="nofollow">http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...</a>