If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for payment processing.
Thanks RB
If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for payment processing.
Thanks RB
Storage of card data is not the deciding factor for PA-DSS scope. If the application handles card data, even if it does not store it, it could be in scope.
See p. 16 of the PA-DSS Program Guide for the "To Which Applications Does PA-DSS Apply?" section: https://www.pcisecuritystandards.org/documents/PA-DSS_Program_Guide_v3_1.pdf
Included in that section is a list of types of applications to which it does not apply.
If in doubt, it is best to speak with a PA-QSA; that is the type of assessor that performs PA-DSS validations. They can work with you on whether your application is eligible.
I've said "likely" in many places above because depending on your application's place in the payment chain, certain tokenization models, other "scope reduction" solutions, etc., it can change the situation. For example, I am aware of some DTMF-oriented payment applications where the solution provider was in scope for PCI DSS themselves, but did not need PA-DSS validation on their software due to the hosting model.
Notice that if you are passing the credit card data to a different service provider you are required to monitor his compliance statues