Online Express and PCI Compliance for embedded forms

Melissa Anderson · July 2017

Hi,

I am wondering what other organizations are doing to ensure PCI compliance on their websites for Online Express donation forms. Our website is not PCI compliant, so we now have an issue that we cannot embed Online Express donation forms on the website for security issues. From my understanding, even though Online Express is PCI compliant, once the forms are embedded on your website to maintain compliance the website must be.

Thanks for any help with this!

Melissa

Jane Nuzzo · July 2017

Hi-

We encountered the exact same issue. Our website is so large that we have come to learn our IT will NOT secure a page for us to embed the OLX donation form (because they would have to secure the entire site to be PCI compliant). This, of course, has come as a surprise to us. When we upgraded to NXT and bought into the OLX concept, none of these potential issues were made known to us by Blackbaud. We feel a bit hoodwinked to say the least.

We are troubleshooting this now. One option we are looking into is to go onto a sub-domain for just the donation page (but costs and web development are a great concern). Another option we are exploring is finding a completely different vendor for just handing online donations (such as a web page with Square Space). Lastly, we are stuck with and must remain on NetCommunity indefinitely (which we are trying to get off of because of how antiquated the system is).

At this point, none of these options are ideal.

Hope this helps.

Jane

Paul Sheen · July 2017

We also have experienced this issue with respect to PCI compliance. In order to mitigate this the best we can, we created a new site using https (which requires the purchase of an SSL certificate), do regular vulnerability scans and implemented file integrity monitoring (we have a system that ensures that the files are not being tampered with) on the files in question. We are trying to follow as many best practices as possible.

Depending on how aggressive your QSA is (if you're not just doing a self-assessment), this may or may not be enough.

I would highly agree that putting the onus on the the organization to follow PCI practices is both time- and money-consuming, and a real short-coming of Online Express. We migrated from the Sphere product which fully hosted the donation form and it makes PCI compliance a non-issue. The long-term solution should be hosting of the forms completely on the OLX platform.

Andy Schroeder · August 2017

Paul,

Thanks for the info. We are currently looking to redesign a website and are hoping to implement OLX. We currenly have no issues with PCI Compliance as our donation page is hosted by a third party but we hoped to end that relationship in order to launch OLX. I apprerciate the heads up on the barriers we can expect to encounter. Good Luck.

Paul Sheen:

We also have experienced this issue with respect to PCI compliance. In order to mitigate this the best we can, we created a new site using https (which requires the purchase of an SSL certificate), do regular vulnerability scans and implemented file integrity monitoring (we have a system that ensures that the files are not being tampered with) on the files in question. We are trying to follow as many best practices as possible.

Depending on how aggressive your QSA is (if you're not just doing a self-assessment), this may or may not be enough.

I would highly agree that putting the onus on the the organization to follow PCI practices is both time- and money-consuming, and a real short-coming of Online Express. We migrated from the Sphere product which fully hosted the donation form and it makes PCI compliance a non-issue. The long-term solution should be hosting of the forms completely on the OLX platform.

Kathryn David · August 2017

I recommend SiteLock. They have non profit rates and provide PCI COMPLIANCE.

Sandra Villarraga · September 2017

Melissa Anderson:

Hi,

I am wondering what other organizations are doing to ensure PCI compliance on their websites for Online Express donation forms. Our website is not PCI compliant, so we now have an issue that we cannot embed Online Express donation forms on the website for security issues. From my understanding, even though Online Express is PCI compliant, once the forms are embedded on your website to maintain compliance the website must be.

Thanks for any help with this!

Melissa

Following - we are on the same page. Just found that we won't be able to embed donations forms on our webpage. @Katryn David mentioned SiteLock but wondering what other organizations are doing.

Standish Stewart · February 2018

Kathryn David:

I recommend SiteLock. They have non profit rates and provide PCI COMPLIANCE.

Good morning Kathryn,

Would you have a few minutes this morning to talk about this option? We are facing this same issue and want to explore remotely hosted PCI Compliance options before we setup a physical server in our DMZ to handle these pages. If you are available, then please email me at standish.stewart@tri-c.edu so that we can setup a time to discuss.

Best,

Standish

Holly Anderson · August 2019

Has anyone found a successful solution? This is an old thread, yet we were also unaware of the PCI issue with the embed code until recently (we're not even live yet). Now we're scrambling to find a solution. Any update would be much appreciated!

Chris Martin · August 2019

We recently released the ability to configure Online Express donation forms to use Blackbaud Checkout for credit card processing. One important aspect of using Blackbaud Checkout is that the tech it uses to render the payment capture window is different than how Online Express functioned prior to this option being available.

Prior to BB Checkout being an option, a direct (secure) connection between the donor's browser and the OLX web application is how the entire OLX donation form was loaded...but the actual HTML elements of the forms themselves are inserted directly into the page HTML. This is done directly in the donor's browser (not ever touching the organization's web server)...but the PCI rules are pretty inflexible and the fact that the form that captures card info (i.e. the OLX form used before BB Checkout became an option) doesn't render from an external web page typically causes organizations to conclude that they need to step up one level in the PCI self-assessment questionnaire they need to follow (from SAQ-A to SAQ A-EP).

Well, we believe that the use of the BB Checkout option changes things. When the little BB Checkout window that captures card info appears, it's actually being rendered from an external Blackbaud (PCI-compliant) page. You'll want to confirm with whoever advises your organization on PCI compliance matters, but we believe that this difference in how BB Checkout functions will allow organizations who use OLX donation forms configured this way to qualify for the "easy" PCI self-assessment questionnaire (SAQ-A).

You can "upgrade" any existing OLX form to use BB Checkout by editing the form and on the step where you choose whether to allow credit card processing, you'll see a new option to process using Blackbaud Checkout.

Note that this option is coming to OLX Event and Membership forms in the next few weeks as well.

Thanks!

Chris Martin

Blackbaud Product Management

Keith Scott 2 · September 2019

Hi Chris,

Thanks for this. We are one of the customers who were advised by our compliance colleagues that we could not use OLX payment forms without stepping up to SAQ A-EP. I'm hoping this change will mean that I can go back to them for a review on their decision. I'd love to be able to stop using additional third party workarounds like Eventbrite/Stripe.

However, I will need more detail on how the implementation differs from old OLX form to Checkout forms in order to satisfy IT and Finance colleagues. Can someone at BB provide a technical description of how the form renders from BB servers? Also maybe an explanation of why this script approach has been implemented rather than the more common iFrame solution used by other SAQ A compliant form suppliers.

Keith

Chris Martin · September 2019

Hi Keith Scott‍. The short explanation is that Blackbaud Checkout actually renders form content in an iframe. The original OLX solution inserted form elements directly onto the page in the donor/supporter's browser. That subtle difference is the primary reason most organizations have concluded that the latter requires SAQ A-EP and why our compliance team believes most organizations using OLX configured for BB Checkout will fall under SAQ A.

The reason we chose an implementation that relies on embedding code snippets is that this allows our customers to take that code snippet and insert a PCI-compliant web form onto any page of their website. Other solutions that have the payment form living on a separate web page outside of the organization's main website have the challenges of how to ensure donor confidence that they can trust a donation page with a URL that's different than that of the site they navigated to and whose look and feel doesn't quite match all of the other pages they're familiar with.

Hopefully that helps. Thanks!

Chris Martin

Blackbaud Product Management

Online Express and PCI Compliance for embedded forms

Comments

Categories