Subject: Fw: Fw: Reminder: PCI certificate required
From: "Mike" <[email-masked]>
To: "David Lynch" <[email-masked]>
Date: Mon, 25 Aug 2008 11:31:35 -0400

David,
This is the response I got from my tech.  Can you send me any additional 
info. that is needed?  I will forward it to him.
Thank you,
Mike - LLPS

----- Original Message ----- 
From: "Michael Grove" <[email-masked]>
To: "Mike" <[email-masked]>
Sent: Saturday, August 23, 2008 1:44 AM
Subject: Re: Fw: Reminder: PCI certificate required

> As far as I know we have not been checked for compliance.
>
> We can be tested for compliance at any time.  You should probably contact 
> this guy at PayPal to get more detailed directions on how to do this.  I 
> went to the link that was provided, but could not find anything that gave 
> a year of free service.  It looked like everything required payment up 
> front.
>
> If the enrollment process asks any questions that I need to answer, just 
> let me know.
>
> The only problem we might have is that we are currently storing the CVV 
> number.  They might ask us to remove that from the database, but we will 
> see.  The web site is pretty well locked down, so I would be surprised if 
> we have many problems.
>
> Mike Grove
>
> Customer Service wrote:
>> Mike,
>> Do you know if we already have this in place?  Let me know.
>> Thank you,
>> Mike - LLPS
>>
>>
>> ----- Original Message ----- From: "Lynch, David" <[email-masked]>
>> To: "Customer Service" <[email-masked]>
>> Sent: Thursday, August 21, 2008 10:01 AM
>> Subject: RE: Reminder: PCI certificate required
>>
>>
>> Michael,
>>
>> The Credit Card Associations require all vendors (merchants) to be in
>> compliance with the current PCI Compliance Rules.  This is like making
>> sure your network is secure, not storing CC # with Exp Dates unless it
>> is encrypted. If you have never registered for compliance before go to 
>> Scan Alert site
>> a www.scanalert.com.  You should get a free years when you sign up, I
>> would guess somewhere in the signup flow it will ask who sponsors you.
>>
>> Your previous processor would have had to manage this before paypal, you
>> did not do any audits etc last year? David Lynch
>>
>> Account Manager
>> PayPal.com
>> The safest, easier way to pay online
>>
>> 12312 Port Grace Blvd, LaVista, NE 68128
>>
>> Direct 402 952 8848 Cell 402 253 5570
>>
>> [email-masked]
>> -----Original Message-----
>> From: Customer Service [mailto:[email-masked]] Sent: Thursday, 
>> August 21, 2008 8:52 AM
>> To: Lynch, David
>> Subject: Fw: Reminder: PCI certificate required
>>
>> David,
>> In English, how does this affect us?  Are we already secure?  Can you 
>> explain this better to me?
>> Thank you,
>> Mike - LLPS
>>
>> ----- Original Message ----- From: <[email-masked]>
>> To: "Labor Law Poster Service" <[email-masked]>
>> Sent: Wednesday, August 20, 2008 11:02 PM
>> Subject: Reminder: PCI certificate required
>>
>>
>> Dear Labor Law Poster Service,
>>
>> I'm writing to remind you that you are required to be compliant with the
>>
>> Payment Card Industry (PCI) security standards.
>>
>>
>> ----------------------------------------------------------------
>> What are the security standards my business needs to meet?
>> ----------------------------------------------------------------
>> The Payment Card Industry (PCI) mandates that you meet minimum online 
>> security requirements. This means enrolling with a Visa and 
>> MasterCard-certified security vendor for PCI certification services 
>> consisting of Quarterly Security Scanning of your office and store
>> Internet connections as well as your website, plus the completion of a 
>> Security Self-Assessment Questionnaire.
>>
>> For more information on this mandatory cardholder information security 
>> programs please go to:
>>
>> Visa USA - 
>> http://usa.visa.com/business/accepting_visa/ops_risk_management/cisp.htm
>> l
>>
>> MasterCard - https://sdp.mastercardintl.com/cgi-bin/mainpage.cgi
>>
>>
>> ----------------------------------------------------------------
>> PayPal's here to help - with cost-saving compliance resources.
>> ----------------------------------------------------------------
>> -- We've contracted with ScanAlert, certified PCI vendor, to help our 
>> customers get in compliance at no cost for the first year.
>>
>> --Enroll with ScanAlert online at: http//www.scanalert.com/
>>
>>
>>
>> ----------------------------------------------------------------
>> How does my business become - and stay - compliant?
>> ----------------------------------------------------------------
>> 4 steps to staying PCI compliant:
>>
>> 1.  Complete and pass the annual security self-assessment questionnaire.
>> 2.  Complete and pass quarterly security scans of your internet 
>> infrastructure.
>> 3.  Get your certificate of compliance.
>> 4.  Fax your certificate to PayPal at (402)951-0448.
>>
>>
>> ----------------------------------------------------------------
>> Please fax us your PCI certificate.
>> ----------------------------------------------------------------
>> If you do not certify your compliance within 30 days, we will need to 
>> disable your Website Payments Pro account until you do so.
>>
>>
>> ----------------------------------------------------------------
>> What if my business can't become certified within the timeframe you
>> request?
>> ----------------------------------------------------------------
>> You can prevent your Website Payments Pro account from being disabled
>> by:
>>
>> 1.  Demonstrating a plan of action to become PCI compliant.
>> 2.  Reply to this email with a plan of action within 7 days.
>> 3.  After your initial request, you have 30 days to obtain your
>> certificate of compliance.
>>
>>
>> ----------------------------------------------------------------
>> Questions?
>> ----------------------------------------------------------------
>> Write to us at [email-masked]
>>
>> Thank you for your time and attention to this matter. As always, we 
>> appreciate your business.
>>
>> (1) If you are not PCI-compliant, the Credit Card Association may impose
>>
>> fines of more than $500,000per event for data security compromises.
>>
>> Keep in mind, if merchants experience a data breach, they are ultimately
>> the ones held responsible for it.
>>
>> Thank you for using PayPal!
>> The PayPal Team
>>
>>
>> ----------------------------------------------------------------
>> PROTECT YOUR PASSWORD
>>
>> NEVER give your password to anyone, including PayPal employees. Protect 
>> yourself against fraudulent websites by opening a new web browser (e.g. 
>> Internet Explorer or Netscape) and typing in the PayPal URL every time
>> you log in to your account.
>>
>>
>> ----------------------------------------------------------------
>>
>>
>> Please do not reply to this email. This mailbox is not monitored and you
>>
>> will not receive a response. For assistance, log in to your PayPal
>> account and click the Help link in the top right corner of any PayPal 
>> page.
>>
>> PayPal Email ID PP1023
>>
>>
>>
>>
>>
>>
>>
>
>