Home
Welcome
The Commerce+ Transaction Server provides stable core commerce execution with a practical path to modular modernization.
Compliance
The following section describes how you can leverage Commerce+ features and functionality to help your site be compliant with different privacy and security standards.
Commerce+ and the PCI Data Security Standard
The Payment Card Industry (PCI) Data Security Standard (DSS), developed by the founding payment brands of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa International, facilitates the global adoption of consistent data security measures.
Addressing the PCI Data Security Standard within Commerce+
The following topics deal with each of the detailed PCI requirements that pertain to Commerce+. Some of the requirements are directly related to the Commerce+ software package. Other requirements are unrelated, or indirectly relate to the Commerce+ software package. For example, indirect requirements can affect your use of the operating system security features to secure Commerce+ files.
Requirement 11: Regularly test security systems and processes
While beyond the scope of Commerce+, it is important to regularly test security systems and processes. Refer directly to the PCI DSS for details on testing requirements.

Welcome
The Commerce+ Transaction Server provides stable core commerce execution with a practical path to modular modernization.
- Notices
- Compliance
  The following section describes how you can leverage Commerce+ features and functionality to help your site be compliant with different privacy and security standards.
  - GDPR and Commerce+
    Commerce+ provides documentation and functions that your organization can use to help it on the journey to GDPR readiness. If your store operates within the European Union (EU), sells products or services to those people in the EU, or monitors the behavior of EU data subjects, your site likely needs to be GDPR compliant from May 25, 2018.
  - Commerce+ and the PCI Data Security Standard
    The Payment Card Industry (PCI) Data Security Standard (DSS), developed by the founding payment brands of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa International, facilitates the global adoption of consistent data security measures.
    - Addressing the PCI Data Security Standard within Commerce+
      The following topics deal with each of the detailed PCI requirements that pertain to Commerce+. Some of the requirements are directly related to the Commerce+ software package. Other requirements are unrelated, or indirectly relate to the Commerce+ software package. For example, indirect requirements can affect your use of the operating system security features to secure Commerce+ files.
      - Requirement 1: Install and maintain a firewall configuration to protect cardholder data
        Many parts of requirement 1 such as your wireless network or router setup do not directly relate to Commerce+, but the requirements that relate to your site topology are extremely important. You must construct your Commerce+ site so that you never store cardholder data on internet-accessible systems. Additionally, Commerce+ sites should always use firewalls to separate themselves from the internet, internal networks, and any other system that is accessible to the internet. Refer directly to the PCI DSS for details on this requirement.
      - Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters
        The detailed requirements in this section are relevant to Commerce+. Review each point carefully.
      - Requirement 3: Protect stored cardholder data
        The detailed requirements in this section are relevant to Commerce+. Review each point carefully.
      - Requirement 4: Encrypt transmission of cardholder data across open, public networks
        The detailed requirements in this section are relevant to Commerce+. Review each point carefully.
      - Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs
        Although antivirus software is outside the scope of Commerce+, protecting your servers and network from malicious software should always be a priority for a responsible network administrator. Commerce+ is designed, developed and tested on systems running antivirus software.
      - Requirement 6: Develop and maintain secure systems and applications
        As your business needs change, you or your business partners might customize your Commerce+ site. As you do so, you must ensure that the customizations do not compromise your site security. Ensure that your developers understand the requirement to develop secure systems by referring to the PA-DSS and PCI-DSS.
      - Requirement 7: Restrict access to cardholder data by business need to know
        The detailed requirements in this section are relevant to Commerce+. Review each point carefully.
      - Requirement 8: Identify and authenticate access to system components
        The detailed requirements in this section are relevant to Commerce+. Review each point carefully.
      - Requirement 9: Restrict physical access to cardholder data
        Requirement 9 deals with physical site security and is well beyond the scope of Commerce+. Refer directly to the PCI DSS for details on the requirement.
      - Requirement 10: Track and monitor all access to network resources and cardholder data
        The detailed requirements in this section are relevant to Commerce+. Review each point carefully.
      - Requirement 11: Regularly test security systems and processes
        While beyond the scope of Commerce+, it is important to regularly test security systems and processes. Refer directly to the PCI DSS for details on testing requirements.
      - Requirement 12: Maintain a policy that addresses information security for all personnel
        This requirement is not directly related to Commerce+. Refer directly to the PCI DSS for requirements and details on how to develop your information security policies.
    - PCI Assessment Services for Commerce+
      There is more to navigating the PCI standard and the certification procedure than simply installing Commerce+ and making the adjustments that are outlined in the preceding sections. There are significant portions of the standard that, although it applies to your site, do not apply to the software application. To assist you in completely addressing these parts of the standard, HCL has the expertise and resources to assist your site in becoming PCI compliant.

Requirement 11: Regularly test security systems and processes

While beyond the scope of Commerce+, it is important to regularly test security systems and processes. Refer directly to the PCI DSS for details on testing requirements.

Note: Section 11.5 of the PCI-DSS makes recommendations regarding the deployment of a file integrity monitoring system. When configuring the files to monitor, add all files under the WC_installdir and WC_profiledir. This ensures that you monitor critical configuration files such as wc-server.xml, log files, and custom key files.