Implementierung der PCI-Konformität

Grow

Included:

• Implementation of basic PCI-DSS compliance checks for one Shopify store using Shopify Payments or a single third-party gateway.
• Review and configuration of secure transmission (SSL/TLS) and basic access restriction policies for up to 5 staff accounts.
• Setup of password standards and session timeout settings in line with PCI recommendations.
• Delivery of 5–7 prioritized recommendations for improving compliance further.
• Email and CRM-based support with standard priority (responses within 3–4 business days).

Not Included / Limitations:

• No vulnerability scanning, penetration testing, or completion of SAQ forms on your behalf.
• Limited to one storefront, one gateway, and 5 accounts—additional scope requires a new engagement.
• No multi-region or multi-gateway setup beyond basic advisory.
• All services delivered exclusively online—no on-site or in-office assistance.

Advanced

Included:

• Deployment of intermediate PCI-DSS alignment for up to 2 Shopify Plus storefronts or custom checkout environments.
• Configuration of secure access control policies, logging for critical transactions, and file integrity monitoring basics.
• Integration of two payment gateways with compliance checks and recommendations for SAQ preparation.
• Advisory on PCI network segmentation and vulnerability management processes.
• Email and CRM-based support with priority response (within 1–2 business days).

Not Included / Limitations:

• No formal completion of PCI-DSS certification or third-party audits.
• Limited to two storefronts, two gateways, and basic monitoring—expanded coverage requires a separate engagement.
• No advanced managed security services or custom security software.
• Remote-only delivery—no on-site setup or training.

Plus

Included:

• Enterprise-grade PCI-DSS compliance implementation for up to 4 Shopify Plus storefronts or global custom checkout systems.
• Configuration of advanced access restrictions, file integrity monitoring, logging systems, and secure key management.
• Advisory for up to 4 payment gateways on SAQ types, audit preparation, and vulnerability scanning schedules.
• Setup of incident response workflows for payment data breaches and suspicious transaction alerts.
• Follow-up consultation within 90 days to review compliance status and refine settings.
• Email and CRM-based support with high priority (responses within 24 hours).

Not Included / Limitations:

• No direct submission of PCI-DSS certification or liaison with acquiring banks or card schemes—external auditors or processors are required for formal approvals.
• No coverage beyond four storefronts or four gateways—larger projects require a new engagement.
• Services delivered exclusively online—no on-site implementation or audits.