Frequently Asked Question

Applications which are PA-DSS validated have been assessed by a PA-QSA as meeting all PA-DSS requirements. This means the application, when properly installed and configured, is capable of supporting the merchant's PCI DSS compliance.  

Using a PA-DSS validated application does not reduce the scope of a merchant's cardholder data environment, nor does it guarantee PCI DSS compliance. The boundaries of the cardholder data environment are not affected by the presence or absence of a PA-DSS validated payment application, and payment applications are in scope for a merchant's PCI DSS assessment. During the PCI DSS assessment, the assessor must verify that the application is implemented and configured in a PCI DSS compliant manner.  The PA-DSS Implementation Guide, provided by the application vendor for each PA-DSS validated application, is a valuable tool for the PCI DSS assessor to understand how the application is implemented and whether it is configured correctly.

Additionally, it should be noted that some payment brand rules may require the use of PA-DSS applications. Merchants should contact their acquirer or the payment brands directly, as applicable, to determine if they have any requirements. Payment brand contact details are provided in FAQ 1142 -  How do I contact the payment card brands?.