When Does A Telephone Company Become A PCI Service Provider?
Written by Walter ConwayApril 21st, 2010
PCI Columnist Walt Conway asks, "At what point does a voice over Internet Protocol (VoIP) vendor become a PCI service provider?" In other words, at what point does VoIP begin to affect your PCI compliance?
To that end, Conway was once asked, "If a VoIP network is used for cardholder data, what sections of PCI DSS would apply?" It was an easy question to answer: All of them.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
3 Comments | Read When Does A Telephone Company Become A PCI Service Provider?
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
April 22nd, 2010 at 9:30 am
Thank you for touching on this subject. You bring up a good point that I have not heard before: phone services could also be considered “service providers”.
Because there is so much misinformation when it comes to “VoIP,” merchants as well as merchant service providers,are being told that VoIP is non-compliant but we are learning that not all internet protocols are the same. By mere definition, if we look at the phone service vendors as “service providers,” we can then take the necessary steps to PCI compliancy.
July 22nd, 2010 at 1:57 pm
I would like to get a discussion group on this subject, there are many who have “internal” service providers in large enterprises that need to “help” the Network team understand that even if it is in the Corporate WAN, my VOIP to my call centers is in scope, and should be encrypted, because not all the people on the WAN need access to that data…
February 24th, 2011 at 7:35 pm
I think PCI DSS is clear on this point:
“Entities such as telecommunications companies that only
provide communication links without access to the application layer of thecommunication link are excluded.”
If you are a VOIP provider and your customer is transmitting cardholder data over your VOIP service, then it is the customer (NOT the VOIP provider) that is responsible for encrypting cardholder data before it transmits it as a VOIP call. Unless the Telecommunications company has been contracturally engaged to be part of the clients PCI DSS compliance, then it is just passing on the call and is not responsible for the contents of the call, no matter WHAT technology is being used to transmit the call.