SisterJudith -- Thank you.  This is useful.

So once we have determined we can self-certify, then the question becomes where do we submit that form?

1) I have the PCI Compliance Team email address at Intuit.  Since they never respond to anything I send them, I'm not going to bother with the form unless I know they will do something with it.

2) An alternative is to call Security Metrics.  I can envision how that conversation would go:  "Hi Security Metrics, I'm not hiring you or paying you a single dime.  Please give me information about where within Intuit you submit your compliance reports.  Oh -- and can you also confirm I have figured out the right form during my readings on the subject?"

So SisterJudith's information is useful, and I'm sitting this one out until something changes.

-- Zagone