* I don't store process or transmit any cardholder data on my premises, but rely entirely on third party services to handle these functions.
* The third parties I use for handling storage, processing, and transmission of cardholder data is PCI certified.
* I don't store any cardholder data in electronic format.
* What physical cardholder data I store is only paper reports and copies of receipts and is never received electronically?
Yes? Then you can self-attest (presumably at any time, such as when asked, but dont' quote me) compliance. You'll sign a document that says:
* I read the PCI DSS (sorry).
* The above conditions about not handling cardholder data are true.
* (9.6) All paper and electronic media that contain cardholder data is physically secure.
* (9.7a) Strict control is maintained over internal and external distribution of any media containing cardholder information.
* (9.7b) Controls include (9.7.1) such media being "classified" so everyone knows its confidential and (9.7.2) when transported it's sent by courier or other trackable secure carrier.
* (9.8) Processes and procedures are in place to ensure management approval before moving any media containing cardholder data from a secure area.
* (9.9) Strict control is maintained over storage and access of media containing cardholder data.
* (9.10) Cardholder-carrying media is destroyed as soon as it is no longer need for legal or business reasons, and (9.10.1) hardcopy material is cross-cut shredded, incinerated, staked through the heart, chained in silver, buried under a full moon in a Scottish peat bog, and pulped so that cardholder data cannot be reconstructed.
* (12.8) Cardholder data once shared with service providers are secured with policies and procedures that:
* (12.8.1) Include keeping (yes wait for it) a list of service providers
* (12.8.2) You have written agreements with those providers that say "yes we know what PCI means"
* (12.8.3) You have some due diligence process for choosing providers that know what PCI is.
* (12.8.4) You have a policy for monitoring those providers PCI compliance so if they suddenly decide PCI is a big joke you'll stop funnelling cards to them.
That's it. No app pentests required. No firewalls installed. More than half of it is about physical storage of cardholder records which you aren't doing because that's crazy.
I think you'll be fine.