I want to preface this by saying that I am aware that no one here can tell me authoritatively whether I am PCI compliant, since only licensed people can do that.
Instead, I'm asking what your experience was in seeking out compliance. My site is run on Drupal 7, CiviCRM 4.6, and we use Authorize.net for our payment processor. We have SSL. Do you have any helpful intel on how hard or easy this will be for us?
edited to add: We are hosted by CiviHosting
A great explanation of PCI compliance and things an organization should consider relating to PCI compliance is available from this CiviCon Denver 2015 talk: CiviCon Denver Data Security and Payment. See my answer here for other relevant info: https://civicrm.stackexchange.com/a/10453/105
We also use Drupal 7 and Civi 4.6, but are hosted on MediaTemple and use iATS for our payment processor. The biggest issue will be whether you take payment directly onsite or offsite (I'm not familiar with Authorize.net). In and of itself, a MediaTemple VPS is not PCI compliant. We had to take steps ourselves to make sure our server met the PCI criteria. iATS has their clients enroll in PCI Smart which is a PCI compliance testing and reporting program through TrustWave. We used those scans as guidance for what we needed to adjust technically on the server to meet PCI guidelines and the self-report to determine in-house processes to meet the PCI criteria.
I have had experience with AuthorizeNet and PCI compliance both with CiviCRM installs and other sites with custom configurations. the process is the same, generally the merchant account provider will require scans through a service provider. You will most likely need to make adjustments to server settings, primarily port/firewall adjustments. Depending on your hosting provider the ease of this may vary. Shared hosting may cause some issues as they may not make the changes.
Keep in mind that PCI compliance goes beyond your website transactions. If you process any Credit Card information from your office network via the AuthorizeNet Portal or a swipe machine your office network will be scanned and some adjustments may need to be made there also.
The process involves filing out a questionnaire and scans. Also most providers require regular scans to maintain compliance. It's important to maintain compliance as most merchants account providers will charge higher fees if you are not compliant.
