I'm hoping that someone can help me understand the Visa CISP and Mastercard SDP security standards a little better.

We are a book wholeseller that sells books to libraries and colleges. We have a web site and take credit card orders through that web site, but we also have a swipe machine in the office where we process some credit cards as well. In addition, we are set up so that if a student places an order at a college bookstore's web site, that order comes through to us and we fulfill that order.

I have contacted several of the companies that do the vulnerability scans and they want the number of ISP's that need to be scanned. Could someone please give me a better idea as do what will count as far as needing to be scanned?

Thanks