A cross-connect is any connection between facilities provided as separate units by the datacenter.
In other words, if you rent a cage, you can run cables betweeen your various racks and they are not really considered "cross connects".
But typically a user facility is a rack. Consider the uplink to a network provider. The line that runs from you to the telco's rack is a cross-connect. Any other between-rack cable run falls in this category. Even if the datacenter is bundling network access, it's still a cross-connect. (It's also typical to have a meet-me room that is the center of all the cross-connects, it's a patch-panel room or cage.)
This matters a lot to the datacenter because the crossconnect uses their overhead cable trays and typically comes with both a setup and a monthly charge.
Update: If itemized, the charge can be $100 - $300, and can depend on various things like the type and speed of the line.
I should also add that sometimes people will unfortunately use "cross-connect" in its literal english sense when referring to any kind of a network connection, even if it's in a datacenter context. I've seen fiber metro links between different buildings and uplink bandwidth contracts quoted as "cross-connects.
First, DON'T capitulate. He is not only an idiot but DANGEROUSLY wrong. In fact, releasing this information would violate the PCI standard (which is what I'm assuming the audit is for since it's a payment processor) along with every other standard out there and just plain common sense. It would also expose your company to all sorts of liabilities.
The next thing I would do is send an email to your boss saying he needs to get corporate counsel involved to determine the legal exposure the company would be facing by proceeding with this action.
This last bit is up to you, but I would contact VISA with this information and get his PCI auditor status pulled.
Best Answer
It refers to the technologies used that make up your service: your web application language/framework depends on (is stacked on) your web server, which talks to (stacks on) a specific database flavor, and these run on (stack with) specific operating systems. So you might have a stack like this:
P PHP
M MySQL
A Apache
L Linux
to make up the LAMP stack, or like this:
C C#
S Sql Server
I IIS
W Windows
to make up a WISC (windows) stack. Other common "stacks" are WIMP (Windows, IIS, MySql, PHP) and WAMP (Windows, Apache, MySQL, PHP).
And those are just a few of the simple ones. It doesn't even begin to take into account Oracle, Ruby, Java, Python, and numerous other options that could sit at various points. You could have a MySql running on linux serving as the database for a web app running in Windows, or a web service tier using a completely different technology set from your application tier (which might even be a desktop app).
The important thing is we often talk about whether your stack is windows-based or linux-based, and the reason it's important is because software developers tend to build products with a specific stack in mind, or have experience working with one stack (or family of stacks) but not another. As long as you match up to their stack, the product should work as expected.