Miva Merchant 5.5 PA-DSS Update

[Rick Wilson]

IMPORTANT AND CRITICAL UPDATE FOR ALL 5.5 STOREOWNERS

Dear Miva Merchant Customer,

As many of you already know, July 1, 2010 was the mandatory deadline for all Payment Applications to become PA-DSS Validated. This requirement impacts all payment gateway providers, swipe terminals, and shopping cart vendors like Miva Merchant.

PA-DSS Validation is different from PCI-DSS Compliance. Both are implemented and governed by the PCI Security Council, but in order to maintain your PCI-DSS Compliance as a merchant, you must be running PA-DSS Validated (and properly configured) software.

Miva Merchant recently completed its PA-DSS Audit and have received its Attestation of Validation (AOV) from its Qualified Security Assessor (QSA) and has submitted this to the PCI Security Council for listing on their website as a PA-DSS Validated Application.

Although the validation is now complete, it will take approximately 6 more weeks in order to be listed on their website. In the meantime, should your merchant provider need proof of validation, you should be able to use our AOV (Attestation of Validation) to satisfy the requirement. http://www.mivamerchant.com/html_ema...PA-DSS_AOV.pdf

Please note: In order to maintain your PCI –DSS Compliance, you must utilize Miva Merchant 5.5 Production Release 7 (Fully Patched) AND follow our PA-DSS Product Installation Guide when configuring your Miva Merchant online store. Download here: http://www.mivamerchant.com/html_ema...Guide_v1.0.pdf

If you need any assistance configuring your store, contact your Host or Miva Merchant at (858) 490-2570.

As always, we are here to make your store and your customer’s experience the best possible.

[Eric]

Re: Miva Merchant 5.5 PA-DSS Update

Hi Rick,

One suggestion from our customers:

Is their a video for the PA-DSS Checklist screen to show people how to properly setup the Password Settings and Timeouts to have those items change from Fail to PASS. The line item does try to explain what needs to be set, but some users are a bit confused and maybe a screen shot of what the sample Password Settings and Timeouts screen should be to generate a PASS on those line items would be good, perhaps on the blog?

Also is there a video/guide/KB article for people to show them how to walk through the KeyWizard selecting the 3rd option to store the Private Key in the same server as the webserver in MivaSQL format.

Thanks on behalf of others as well

[Rick Wilson]

Re: Miva Merchant 5.5 PA-DSS Update

Not yet, but that's a good idea. I'll get something done.

[Pete McNamara]

Re: Miva Merchant 5.5 PA-DSS Update

Rick,

I just went to the PCI Security Standards site (https://www.pcisecuritystandards.org) to the Validated Payment Applications section and Miva Merchant is still not listed as a Validated Payment Application. Is there an issue? Four and a half months seems an awfully long time for them to get around to listing MM as approved.

Pete

[Rick Wilson]

Re: Miva Merchant 5.5 PA-DSS Update

They're very backlogged and we're told current average wait is 10 months.