Are you asking BV Software specifically, or all the lurking merchants in general?

The major credit card companies are giving merchants until 2010 to ensure that all applications are PABP certified or PCI compliant. PABP certified is used for packaged software (like BV Commerce 5) and PCI is used for hosted services and hosting companies.

There are 4 levels of merchants and the deadlines are different for each one.
Level 4 Merchants - Process 0 to 20,000 transactions per year
Level 3 Merchants - Process 20,000 to 1 Million transactions per year
Level 2 and Level 1 Merchants - Process over 1 Million transaction per year

Terms used
Known Vulnerable Applications - Software known to Visa to store unsafe data. (BV Commerce is NOT a known vulnerable appliction)
Certified Applictions - Software that has passed a certification test
New Accounts - New credit card processing accounts for merchants that do not currently process cards

Schedule of Requirements

Phase 1 - January 1, 2008
New Account must not be using Known Vulnerable Applications. A new merchant can use BV Commerce as it is NOT a known vulnerable application. No effect on existing merchants.

Phase 2 - July 1, 2008
Payment processing companies must only certify new software that is also a Certified Application. Current software and customers are not affected. Current merchants are able to use BV Commerce just as they do now.

Phase 3 - October 1, 2008
New Accounts are required to EITHER use a PCI compliant hosting company OR use a PABP certified application. Existing merchants are not affected and can continue to use BV Commerce as normal. New Accounts must use a PCI compliant hosting company if BV Commerce is not certified by this date. We fully expect that BV Commerce will be certified long before this time.

Phase 4 - October 1, 2009
Known Vulnerable applications will be de-certified for credit card processing. BV Commerce is not a Known Vulnerable application and will also be certified by this date. No impact to any BV Commerce merchant.

Phase 5 - July 1, 2010
All merchants will be required to use Certified Application. BV Commerce will have been certified long before this time and there will be no risk/impact to merchants.

Summary - Impact to BV Commerce merchants
BV Commerce 5 is currently 90% compliant and we are working hard to implement the last few remaining features. The major hold back at this point is the requirement that we allow merchants to change encryption keys on the fly on a running store. This will require a service pack to BV Commerce 5 and we will complete certification before the end of this year.

There will be no impact/risk at all to BV Commerce 5 merchants. Existing merchants will have until 2010 to move to a certified solution but BV Commerce 5 will have been certified long before that deadline.

BV Commerce 2004 merchants will need to upgrade to BV Commerce 5 (or a later version) before July 1, 2010 in order to process credit cards with a certified application.

Marcus,


Can you please confirm that BVC 5 will be PCI compliant by the end of this year as you stated in this thread? I'm asking for confirmation because I know that PABP has already been retired/replaced with PA-DSS. I just don't want to have missed something - like this being moved to BV 6 or the time frame for BVC 5 has changed.



Those of us with clients and stores on BV 2004 have to move them up, which means lots of planning and time - especially for heavily customized stores.



Thank you,

Linette

Marcus,


Are you definitely going to certify BVC5 by October?



Thanks,

Linette

I also would like to know about the status of BVC5 and PCI Compliance before licensing this software. Any updates on this subject?

Marcus,

Not to beat an old (not dead) horse, but any further updates on progress with the PCI compliance? We have customers who are asking.

Thanks.

:smile:

Marcus,

Do you have a new target date?

Thanks,
Josh

How about an expected time frame?

2-3 months?
6 months?
1 year?

Service pack 5.5 will introduce most of the updates for PCI-DSS 1.2 but we're not certified yet.

SP 5.5 should implement the technical changes needed for PCI-DSS 1.2 but the actual certification process takes a while longer. So, it is possible that 5.5 will pass the certification and then, yes, it will be certified. However, if the certification authority requires changes it may be 5.6 before we are officially certified.