In this video in this video you will learn.
The answers to the top five questions business leaders ask about PCI and Salesforce
I'm Micaiah from Chargent!
If you're a business leader who wants to make payments easier for your customers on Salesforce,
then you're in the right place.
As we get started today, I want you to know that we have made a really easy to follow
guide that explains all the details of what you need to know about Salesforce and PCI
We've made this available exclusively for folks like you that are watching these videos.
I want you to use the link in the description below to download our “Salesforce PCI guide”
Okay, let's dig it.
We are going to skip the most obvious questions: what is PCI?
for two reasons one I think if you're watching this you probably
already have a general idea and I don't want to waste one of my five on that
number two -- We have already done that video on this channel!
You’ll find a link for that at the end of this video right there.
[points up and left]
Question 1: Why does my organization need to be PCI compliant?
Your organization needs to be PCI compliant to ensure that your customer's payment data
is secure.
Another reason is to protect your brand from getting tarnished by an intrusion where you
lose your customer’s payment data.
Another reason is that breaches cost you a lot of money!
The famous 2013 Target data breach cost them nearly 300 million USD.
[https://www.thesslstore.com/blog/2013-target-data-breach-settled/]
Additionally your company can face fines from visa and mastercard if you don't comply.
Governments can sue you for damages also.
To sum it up, you should be PCI compliant because it protects your organization and
your customers.
Question 2 Is Salesforce PCI compliant?
Yes.
As of January 2021 they are PCI certified.
Salesforce keeps an updated list of which of their clouds have what certifications on
their Trust site.
You can always check back there for the latest on PCI compliance.
As of the filming of this video all of these clouds were listed on Salesforce’s PCI certified
list.
[bring all these onto the screen] B2B Commerce
Einstein Analytics Government Cloud
Salesforce Platform Cloud Experience Cloud (portal or communities)
Sales Cloud Service Cloud
[let's find the current logos of all these]
Question 3: How does my organization become PCI certified?
In short, complete your PCI assessment, submit your assessment to the PCI board, they certify
you!
Of course the actual process is quite a bit more detailed!
Question 4: What are the levels of PCI certification?
You might have heard someone say they are PCI-DSS level 1 compliant.
Which likely made you ask, What are the different PCI levels and what
do they mean?
Well there are 4 levels.
They are based on the number of card transactions your organization processes each year.
Many US businesses fall into PCI Level 4 which is any organization that takes between 1 and
20,000 card transactions per year.
Another way to think about it is less than one-thousand six-hundred and 67 per month.
PCI Level three is for those organizations that process between 20,000 and 1 million
transactions per year Level 2 is 1 to 6 million transactions per
year Level 1 is over 6 million transactions per
year
Question 5: Which attestation form -- or SAQ -- should Salesforce customers use?
Well that is a more nuanced question.
Your PCI level, the one we just reviewed, ties to the type of attestations you can use
to have your compliance certified.
If you are processing payments solely from Salesforce and you are a level 4, then it
is likely that an SAQ-C is a safe bet.
The best thing to do is seek the advice of a qualified-securty-assessor or QSA who can
give you their professional opinion.
However I am going to tackle this topic on another video on this channel.
If you’d like to see that, be sure to subscribe while you are here.
One bonus tip for you.
Please keep in mind that: No organization can absolve or take away another organization's
PCI scope entirely.
Many companies like Salesforce and Chargent can help you reduce your PCI scope, however
if you take cards you will always have some level of PCI compliance burden.
Remember that Hear no card, See no Card, touch no card is the overarching strategy to minimize
your PCI burden.
If you want to learn more about this strategy, then click over to this video.
I will see you over there.
My name is Micaiah and here at Chargent we help make payments easier for smart business
leaders who use Salesforce.
Remember at Chargent we are always here to help!
___________________
In this video in this video you will learn.
The answers to the top five questions business leaders ask about PCI and Salesforce
I'm Micaiah from Chargent!
If you're a business leader who wants to make payments easier for your customers on Salesforce,
then you're in the right place.
As we get started today, I want you to know that we have made a really easy to follow
guide that explains all the details of what you need to know about Salesforce and PCI
We've made this available exclusively for folks like you that are watching these videos.
I want you to use the link in the description below to download our “Salesforce PCI guide”
Okay, let's dig it.
We are going to skip the most obvious questions: what is PCI?
for two reasons one I think if you're watching this you probably
already have a general idea and I don't want to waste one of my five on that
number two -- We have already done that video on this channel!
You’ll find a link for that at the end of this video right there.
[points up and left]
Question 1: Why does my organization need to be PCI compliant?
Your organization needs to be PCI compliant to ensure that your customer's payment data
is secure.
Another reason is to protect your brand from getting tarnished by an intrusion where you
lose your customer’s payment data.
Another reason is that breaches cost you a lot of money!
The famous 2013 Target data breach cost them nearly 300 million USD.
[https://www.thesslstore.com/blog/2013-target-data-breach-settled/]
Additionally your company can face fines from visa and mastercard if you don't comply.
Governments can sue you for damages also.
To sum it up, you should be PCI compliant because it protects your organization and
your customers.
Question 2 Is Salesforce PCI compliant?
Yes.
As of January 2021 they are PCI certified.
Salesforce keeps an updated list of which of their clouds have what certifications on
their Trust site.
You can always check back there for the latest on PCI compliance.
As of the filming of this video all of these clouds were listed on Salesforce’s PCI certified
list.
[bring all these onto the screen] B2B Commerce
Einstein Analytics Government Cloud
Salesforce Platform Cloud Experience Cloud (portal or communities)
Sales Cloud Service Cloud
[let's find the current logos of all these]
Question 3: How does my organization become PCI certified?
In short, complete your PCI assessment, submit your assessment to the PCI board, they certify
you!
Of course the actual process is quite a bit more detailed!
Question 4: What are the levels of PCI certification?
You might have heard someone say they are PCI-DSS level 1 compliant.
Which likely made you ask, What are the different PCI levels and what
do they mean?
Well there are 4 levels.
They are based on the number of card transactions your organization processes each year.
Many US businesses fall into PCI Level 4 which is any organization that takes between 1 and
20,000 card transactions per year.
Another way to think about it is less than one-thousand six-hundred and 67 per month.
PCI Level three is for those organizations that process between 20,000 and 1 million
transactions per year Level 2 is 1 to 6 million transactions per
year Level 1 is over 6 million transactions per
year Question 5: Which attestation form -- or SAQ
-- should Salesforce customers use?
Well that is a more nuanced question.
Your PCI level, the one we just reviewed, ties to the type of attestations you can use
to have your compliance certified.
If you are processing payments solely from Salesforce and you are a level 4, then it
is likely that an SAQ-C is a safe bet.
The best thing to do is seek the advice of a qualified-securty-assessor or QSA who can
give you their professional opinion.
However I am going to tackle this topic on another video on this channel.
If you’d like to see that, be sure to subscribe while you are here.
One bonus tip for you.
Please keep in mind that: No organization can absolve or take away another organization's
PCI scope entirely.
Many companies like Salesforce and Chargent can help you reduce your PCI scope, however
if you take cards you will always have some level of PCI compliance burden.
Remember that Hear no card, See no Card, touch no card is the overarching strategy to minimize
your PCI burden.
If you want to learn more about this strategy, then click over to this video.
I will see you over there.
My name is Micaiah and here at Chargent we help make payments easier for smart business
leaders who use Salesforce.
Remember at Chargent we are always here to help!