IMS point of view brief on Retail Pro's new EFT strategy and partner-Merchant Warehouse, and how this should impact merchants' thinking about their PCI-DSS compliance practices moving forward.

1. Phone: 1.484.482.1600 Contact Us For More Information WWW.IMS-POS.COM
Topic: Retail Pro® and PCI Compliance – What You Need To Know
There has been much communication and confusion recently about Retail Pro® and PCI Compliance. IMS
customers have been receiving information from Retail Pro®, Merchant Warehouse (MW - Retail Pro’s
EFT exclusive provider) and Shift 4®.
IMS has prepared this Point of View (POV) to help our customers understand what is happening and to
help you make the most informed choice for meeting PCI-DSS compliance standards not just for today,
but for moving forward.
PCI SECURITY STANDARDS
It is YOUR responsibility as a merchant to understand what YOU need to do to be fully PCI Data Security
Standard (PCI-DSS) compliant. Your Payment Application Data Security Standard (PA-DSS) validated POS
software is only one of many PCI-DSS compliance requirements. PCI Security Standards are available at
WWW.PCISECURITYSTANDARDS.ORG. According to the PCI Security Council:
“Use of a Payment Application Data Security Standard (PA-DSS) compliant application by itself
does not make an entity PCI DSS compliant, since that application must be implemented into a
PCI DSS compliant environment and according to the PA-DSS Implementation Guide provided by
the payment application vendor.”
There are 12 primary requirements listed below:
Build and Maintain a Secure Network and Systems 1. Install and maintain a firewall configuration to
protect cardholder data
2. Do not use vendor-supplied defaults for system
passwords and other security parameters
Protect Cardholder Data 3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across
open, public networks
Maintain a Vulnerability Management Program 5. Protect all systems against malware and regularly
update anti-virus software or programs
6. Develop and maintain secure systems and
applications
Implement Strong Access Control Measures 7. Restrict access to cardholder data by business
need to know
8. Identify and authenticate access to system
components
9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks 10. Track and monitor all access to network
resources and cardholder data
11. Regularly test security systems and processes
Maintain an Information Security Policy 12. Maintain a policy that addresses information
security for all personnel

2. Phone: 1.484.482.1600 Contact Us For More Information WWW.IMS-POS.COM
There are numerous sub-requirements under each main area. To find out about these requirements,
there is a full complement of resources, including a Self Assessment Questionnaire (SAQ), on the
WWW.PCISECURITYSTANDARDS.ORG website.
RETAIL PRO®’S COMPLIANCE APPROACH
As part of Retail Pro’s PA-DSS compliance responsibilities, it must complete a yearly validation process
with an approved Payment Application Qualified Security Assessor (PA-QSA). This year’s validation date
is June 21, 2014.
This means that any software versions and associated EFT link-system partners that Retail Pro® wishes
to be PA-DSS compliant and acceptable for new deployments, must be included in this validation
renewal. Versions and systems included in the re-validation include:
1. Retail Pro® V9.2
2. Retail Pro® Prism
3. Merchant Warehouse gateway services
This means that Retail Pro® V8.6 is only acceptable for pre-existing deployments (validated according to
PA-DSS V1.2). That also means that your legacy Monetra based EFT Links to Mercury, First Data, and
WorldPay, as well as the Shift 4® EFT Link, will continue to function as they currently do (validated
according to PA-DSS V2.0) until they are moved to sunset status at some point in the future.
The Shift4® 4Go® product has not been tested nor certified by Retail Pro International (RPI) for
operation with Retail Pro® products, and RPI has not developed, tested or certified any interface
between Retail Pro® and 4Go®.
WHAT THIS MEANS FOR YOU
For those customers who currently use the legacy EFT links listed above, your pre-existing deployments
will continue to work and you will continue to be PA-DSS validated as stated above. Any legacy EFT links
will not be PA-DSS compliant for new deployments after the re-validation date. If you are planning on
new deployments of any kind, these must use the Merchant Warehouse EFT solution.

3. Phone: 1.484.482.1600 Contact Us For More Information WWW.IMS-POS.COM
WHY MERCHANT WAREHOUSE?
In making this strategic decision, Retail Pro® considered not only its current PA-DSS validation
requirements, but how it could best support its customers in the rapidly advancing world of EMV and
mobile-digital payments. As stated in previous Retail Pro® communications, as well as IMS’s own blog
post communication, “EMV. Chip and Pin. What You Need To Know”, Retail Pro® has selected Merchant
Warehouse as its sole EFT partner after a thorough due-diligence review. Some of the reasons for
selecting Merchant Warehouse include:
 MW can act as both a gateway and processor - using either MW processing or your processor
 Gateway services include fully PA-DSS compliant advanced data encryption technologies
tokenization and point-to-point encryption
 The Genius Customer Engagement Platform enabling:
o EMV ready payment acceptance
o Secure credit card payments
o Acceptance of yet-to be-determined mobile payments and various promotional
payments such as gift cards, coupons, loyalty payments, etc.
ARE YOU PCI-DSS COMPLIANT?
Again, being PA-DSS compliant does not mean you are fully PCI-DSS compliant, as being PCI-DSS
compliant includes more than just having a PA-DSS compliant POS system. And perhaps more
importantly, are you taking all the steps necessary to protect yourself against a large scale data breach?
IMS’s RECOMMENDATION
IMS wants its customers not only PCI-DSS compliant, but to be as protected as possible against a data
breach. To that end, we recommend an implementation roadmap that includes the following:
 Do a PCI Security Council SAQ and utilize a Qualified Security Assessor (QSA) if needed
o IMS can recommend a QSA if needed
 Take appropriate steps to be fully PCI-DSS compliant
 Upgrade to the newly validated Retail Pro®-EFT system including Retail Pro® V9.2 or Retail Pro®
Prism and Merchant Warehouse for gateway services
YOUR NEXT STEPS
IMS understands this is a business critical and emotional issue. Call us at 1-484-482-1600 to discuss your
options and how you should proceed.