When it comes to succeeding online it really does pay to “stick to the knitting”. Do what you do best, and leave the really, really tricky bits to the experts!

What do I mean? Let's say that you make the best Widgets on the planet and you plan to sell them online via your flash website. But how are you going to accept payments? By credit card, right? But what about PCI Compliance?

Here are some tips:

General tips

Ensure you are familiar with all of the relevant standards, compliance requirements and legal implications including: PCI DSS, Privacy Act, and data retention requirements for the IRD. Be sure to create backups, and retain them for the required amount of time – not just for emergencies, but for legal purposes.

If you are large enough or a specialist IT shop, then creating-maintaining your own eCommerce environment may be viable, but if you know zip about online payments, then be sure to read about outsourcing below!

Keep work and play separate. Use different passwords at work and home, and don't use your work PCs for surfing. Remember: these are the same machines that maybe hold your digital assets, business plans, client data, and so on.

Consider dedicating one work PC to banking, set transfer limits and check your accounts regularly! Emerging technologies Don't ignore the growth in the mobile space. Your customers are likely going to want to order and pay for their Widgets via their mobile or iPad – is your online presence geared for this? Use social media to your advantage.

Don't forget though, when setting up a Twitter or Facebook presence, you will need to respond to your online clients and keep updates informative, relevant and frequent. Additionally, as you grow your company you will need more and more documented policies and procedures. There are plenty of off-the-shelf policy documents sets ranging in price and quality. You could save yourself time and effort by checking out the SANS Security Policy Project (www.sans.org/ security-resources/policies). The policies there are free and easily customisable. And keep an eye on virtualisation and cloud computing!

PCI Compliance

If you haven't heard of this yet – and you store, transmit or process credit cards – then expect to hear from your Acquiring Bank sometime soon!The bottom line is, if you accept, store or transmit card holder data (credit or debit cards) then you need to be PCI compliant, and you are required to validate annually. The PCI DSS has 12 main requirements, with nearly 250 sub-requirements – things like installing and maintaining firewalls, anti-virus, file integrity monitoring, policy and agreements with your service providers, etc. Outsourcing Consider outsourcing payments!

Even the big online players like Trade Me outsource their payments to a Service Provider Gateway.

Outsourcing of hosting?

Benefits include a smaller PCI self-assessment questionnaire. At the top of the food chain, those processing large numbers of credit cards are required to undergo an independent Third Party assessment which costs thousands of dollars annually. Others must obey the same rules – but can fill out a self-assessment questionnaire called an SAQ (these come in four ‘flavours': A, B, C and D).

SAQ A is the smallest questionnaire for merchants who outsource all cardholder data functions. And another thing: you may find yourself defined as a ‘service provider' to a merchant who needs to be PCI compliant.

This means you are designated as providing a service to a fellow merchant – therefore affecting the security of their payment card data. Examples would be if you offer eCommerce hosting, payment services, or perhaps even server or network support. Therefore the merchant – your customer – may ask you for proof of you compliance to the PCI DSS.

Points to remember

• Remember all of the usual advice – patch your systems, use firewalls, keep your anti-virus up to date

• Become familiar with all relevant regularity and commercial compliance requirements • Outsource payments to a PCI compliant payment gateway

• Consider outsourcing your web hosting, but ensure you use a PCI compliant provider

• Keep a watchful eye on social media

• Keep another eye on the mobile space

• Look out for virtualisation and cloud computing

• Be wary of security shysters! There are plenty of resources available for free – start with SANS.org

• Don't forget backups - keep a copy of offsite!