Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix typos in open source PCI README #58

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion SUMMARY.md
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@
* [🚀 Going live](hyperswitch-open-source/going-live/README.md)
* [👀 Monitoring](hyperswitch-open-source/going-live/monitoring.md)
* [🏛️ PCI compliance](hyperswitch-open-source/going-live/pci-compliance/README.md)
* [🍰 It's no rocket science](hyperswitch-open-source/going-live/pci-compliance/its-no-rocket-science.md)
* [🍰 It's not rocket science](hyperswitch-open-source/going-live/pci-compliance/its-not-rocket-science.md)
* [🗒️ Completing the SAQ](hyperswitch-open-source/going-live/pci-compliance/completing-the-saq.md)
* [🔐 Data Security](hyperswitch-open-source/going-live/security.md)
* [♻️ Updates](hyperswitch-open-source/going-live/updates.md)
Expand Down
2 changes: 1 addition & 1 deletion hyperswitch-open-source/going-live/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ This chapter will give you an overview of everything you would need for going li

In order to user Hyperswitch for accepting digital payments through a consumer facing website or mobile application there are three main prerequisites

<table data-header-hidden><thead><tr><th width="187"></th><th></th></tr></thead><tbody><tr><td>Resources</td><td><ul><li>Account with cloud service provider (AWS/ GCP) to host Hyperswitch application</li><li>Contractual relationship and active processing account with payment processor or acquirer (this will be in the form of API keys or merchant identifier)</li></ul></td></tr><tr><td>Technical Know How</td><td><ul><li>For deploying and managing application using Kubernetes</li><li>Handling a Web application written in Rust using Postgres (primary datastore), Redis (distributed key-value store for cached lookups), Prometheus/Grafana (monitoring), S3/CDN (serving static files)</li></ul></td></tr><tr><td>Ensuring Compliance </td><td><p><a href="pci-compliance/its-no-rocket-science.md">Refer here</a> to find out which level of PCI compliance applies to your business.</p><ul><li><strong>Report on Compliance (ROC):</strong> Engage an independent third-party Qualified Security Assessor (QSA) certified by the PCI-SSC to perform the PCI audit and share the findings. The ROC will be prepared by the QSA at the end of the PCI compliance activity. <em>This is required only if your online business processes greater than 1 million card transactions per annum.</em></li></ul><ul><li><strong>Quarterly Network scans:</strong> Engage an <a href="https://listings.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors">Approved Scanning Vendor</a> for conducting quarterly network scans and submitting the scan reports to the payment processor/ acquirer</li></ul><ul><li><strong>Self Assessment Questionnaire (SAQ):</strong> This is an assessment which can be self-completed by a business without engaging an Independent PCI Auditor, <em>if your business processes less than 1 million card transactions per annum</em>. A person responsible for the payment infrastructure within your organization fills out the SAQ. This could be the stakeholder who is the closest to your payment infrastructure - your Dev Ops Manager, or Information Security Officer, or CTO.</li></ul></td></tr></tbody></table>
<table data-header-hidden><thead><tr><th width="187"></th><th></th></tr></thead><tbody><tr><td>Resources</td><td><ul><li>Account with cloud service provider (AWS/ GCP) to host Hyperswitch application</li><li>Contractual relationship and active processing account with payment processor or acquirer (this will be in the form of API keys or merchant identifier)</li></ul></td></tr><tr><td>Technical Know How</td><td><ul><li>For deploying and managing application using Kubernetes</li><li>Handling a Web application written in Rust using Postgres (primary datastore), Redis (distributed key-value store for cached lookups), Prometheus/Grafana (monitoring), S3/CDN (serving static files)</li></ul></td></tr><tr><td>Ensuring Compliance </td><td><p><a href="pci-compliance/its-not-rocket-science.md">Refer here</a> to find out which level of PCI compliance applies to your business.</p><ul><li><strong>Report on Compliance (ROC):</strong> Engage an independent third-party Qualified Security Assessor (QSA) certified by the PCI-SSC to perform the PCI audit and share the findings. The ROC will be prepared by the QSA at the end of the PCI compliance activity. <em>This is required only if your online business processes greater than 1 million card transactions per annum.</em></li></ul><ul><li><strong>Quarterly Network scans:</strong> Engage an <a href="https://listings.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors">Approved Scanning Vendor</a> for conducting quarterly network scans and submitting the scan reports to the payment processor/ acquirer</li></ul><ul><li><strong>Self Assessment Questionnaire (SAQ):</strong> This is an assessment which can be self-completed by a business without engaging an Independent PCI Auditor, <em>if your business processes less than 1 million card transactions per annum</em>. A person responsible for the payment infrastructure within your organization fills out the SAQ. This could be the stakeholder who is the closest to your payment infrastructure - your Dev Ops Manager, or Information Security Officer, or CTO.</li></ul></td></tr></tbody></table>

## Go live checklist:

Expand Down
8 changes: 4 additions & 4 deletions hyperswitch-open-source/going-live/pci-compliance/README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
description: It's no rocket science
description: It's not rocket science
---

# 🏛 PCI compliance
Expand All @@ -14,14 +14,14 @@ The complexity around PCI compliance is often exaggerated, creating closed syste

The current payment networks are built on a chain of trust between banks, card networks, payment processors and merchants. And the result is that _"everyone needs to take responsibility"_ for secure handling of card information.

> PCI compliance is not determined not enforced by any Government body. It is a set of standards created by the Payment Card Industry Security Standards Council.
> PCI compliance is not determined nor enforced by any Government body. It is a set of standards created by the Payment Card Industry Security Standards Council.

Payment Card Industry Security Standards Council (PCI-SSC), was an independent body created by the card networks in 2006. The independent body publishes and manages PCI security standards. However, the enforcement of these standards falls to the card networks and payment processors.

We have open sourced our PCI certified card vault application code along with the deployment scripts which you can self-host. By the time you complete this guide, you will be running a PCI complaint card vault on your server and also be ready to get PCI certification.
We have open sourced our PCI certified card vault application code along with the deployment scripts which you can self-host. By the time you complete this guide, you will be running a PCI complaint card vault on your server and also be ready to get PCI certification.

{% embed url="https://docs.google.com/presentation/d/1inTRp-yvIUjiIuo1f-FBFd1zbUq5IxIbUMzEYpAAUNI/edit?usp=sharing" fullWidth="false" %}

Understand PCI compliance requirements with respect to your application and complete the Self Assessment Questionnaire to obtain PCI compliance:

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th><th data-hidden data-card-cover data-type="files"></th></tr></thead><tbody><tr><td><strong>Understanding PCI compliance requirements</strong></td><td>Understand PCI compliance requirements with respect to your application and transaction volumes</td><td></td><td><a href="its-no-rocket-science.md">its-no-rocket-science.md</a></td><td><a href="../../../.gitbook/assets/Untitled design (14).jpg">Untitled design (14).jpg</a></td></tr><tr><td><strong>Completing the SAQ</strong></td><td>A simplified recipe to fast track obtaining PCI compliance. This includes a project tracker, documentation templates and automation scripts </td><td></td><td></td><td><a href="../../../.gitbook/assets/Untitled design (15).jpg">Untitled design (15).jpg</a></td></tr></tbody></table>
<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th><th data-hidden data-card-cover data-type="files"></th></tr></thead><tbody><tr><td><strong>Understanding PCI compliance requirements</strong></td><td>Understand PCI compliance requirements with respect to your application and transaction volumes</td><td></td><td><a href="its-not-rocket-science.md">its-not-rocket-science.md</a></td><td><a href="../../../.gitbook/assets/Untitled design (14).jpg">Untitled design (14).jpg</a></td></tr><tr><td><strong>Completing the SAQ</strong></td><td>A simplified recipe to fast track obtaining PCI compliance. This includes a project tracker, documentation templates and automation scripts </td><td></td><td></td><td><a href="../../../.gitbook/assets/Untitled design (15).jpg">Untitled design (15).jpg</a></td></tr></tbody></table>
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
description: Demystifying PCI compliance and it's requirements
---

# 🍰 It's no rocket science
# 🍰 It's not rocket science

{% hint style="info" %}
In this chapter, we will look at the levels of PCI compliance, key requirements and we will understand why it is not as complex as it seems to be to obtain PCI compliance.
Expand Down