I've struggled to find a really straight answer that makes me super comfortable to this question after searching SE, PCI basics, drupal.org, AWS resources, and reading the Drupal PCI Compliance White Paper.
I think I am just looking for some confirmation or denial from folks who have set up eCommerce environments before. Perhaps this is because I am overthinking it (I really don't want to expose a small business to unnecessary liability), and perhaps because environments are all different so it's difficult to say.
I'd like to be sure to create a PCI compatible environment using Drupal Commerce with an onsite payment gateway (Authorize.net). In our MOU it will be up to the site owner to ultimately write down their business processes and take the SAQ (recommended, as they should qualify for level 4 from Visa/Mastercard) to say they are PCI compliant, but since I am building the site out I would like to make sure they don't have any trouble with that piece of it.
As long as we are...
- Hosted in a PCI compliant environment (AWS EC2 in this example)
- Have firewall properly configured
- Serving all relevant (but ideally all) pages over SSL
- Use good passwords, no users are shared
- All security updates are made for Drupal and modules promptly
Is that a recipe for a PCI compatible environment? Have I forgotten any pieces?
My second but related question is - Does using Drupal Commerce with Authorize.net (onsite processing) mean the business should use:
- SAQ-A (Card-not-present merchants: all payment processing functions fully outsourced, no electronic cardholder data storage)
- SAQ-EP (E-commerce merchants re-directing to a third-party, PCI compliant service provider for payment processing, no electronic cardholder data storage)
I know Drupal Commerce provides the 'no cardholder data storage' by design, but i'm very unclear on the definition difference between 'all payment processing functions fully outsourced' and 'merchants re-directing to a third-party compliant service provider for processing'.
Thanks for your thoughts!