PCI DSS 3.0 is a mess at the moment. Under PCI DSS 2.0 merchants can relieve most of their PCI DSS burden simply by ensuring that the infrastructure and servi

PCI DSS 3.0 is a mess at the moment. Under PCI DSS 2.0 merchants can relieve most of their PCI DSS burden simply by ensuring that the infrastructure and services that process those payments are PCI certified. The simplest way to do this is simply redirect the customer to a PCI certified payment gateway. PCI DSS 3.0 is much more broad and ambiguous, the current interpretation seems to be that every aspect of a merchants website and infrastructure needs to be PCI compliant, regardless of if it ever sees a credit card or not. The reasoning for the changes seems to be an increased number of compromised websites that would normally not accept credit cards directly, but once compromised the intruder can modify the website as they see fit and fool customers into providing card details. As you can imagine, the amount of work and money it would take to certify every aspect of a merchants web infrastructure is prohibitive, as a result until more clarification arises around the requirements, QSA's are recommending qualifying under PCI DSS 2.0 rather than 3.0.