Frequently Asked Question

Are entities expected to do onsite audits of personnel work-from-home environments?
No, entities are not expected to conduct onsite assessments of work-from-home (WFH) environments, as home environments are not owned or controlled by the entity.
Entities are expected to have controls and processes in place governing how personnel working from home access payment card account data. Controls and processes should also be implemented to provide assurance that payment card account data is protected in accordance with applicable security requirements.
See also the following FAQs:
FAQ 1494: For personnel working from home, is the work-from-home environment considered a “sensitive area” for PCI DSS Requirement 9?
FAQ 1495: Is an assessor required to visit work-from-home environments to determine if personnel are meeting PCI DSS requirements?
Entities are expected to have controls and processes in place governing how personnel working from home access payment card account data. Controls and processes should also be implemented to provide assurance that payment card account data is protected in accordance with applicable security requirements.
See also the following FAQs:
FAQ 1494: For personnel working from home, is the work-from-home environment considered a “sensitive area” for PCI DSS Requirement 9?
FAQ 1495: Is an assessor required to visit work-from-home environments to determine if personnel are meeting PCI DSS requirements?
May 2021
Article Number: 1496
Featured FAQ Articles
Most Recently Updated
-
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
-
Can SAQ eligibility criteria be used for determining applicability of PCI DSS requirements for assessments documented in a Report on Compliance?
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?