Frequently Asked Question

If a P2PE Solution is shown as red or orange on PCI's list of Validated P2PE Solutions, does the solution meet the eligibility criteria for SAQ P2PE?
Yes, P2PE solutions with dates shown as red or orange are considered validated P2PE solutions and meet the eligibility criteria for SAQ P2PE. Dates shown in colors on the PCI SSC list of Validated P2PE Solutions indicate that the solution has not been revalidated in accordance with P2PE program requirements. Orange means that the P2PE Solution revalidation is up to 90 days overdue and red means that the P2PE Solution revalidation is more than 90 days overdue. These colors and their meaning are described at the bottom of each listings page and are defined in the P2PE Program Guide.
P2PE Solutions that are red for more than 90 days will be moved to PCI's list of Point-to-Point Encryption Solutions with Expired Validations. Expired P2PE solutions are no longer considered "validated" per the P2PE Program Guide and the validations are therefore expired. Refer to If a P2PE Solution is on PCI's list of Point-to-Point Encryption Solutions with Expired Validations, does the solution meet the eligibility criteria for SAQ P2PE? for more information.
SAQ P2PE is intended for SAQ-eligible merchants or merchant environments as determined by the individual payment card brands. Refer to Who can use SAQ P2PE? for more information.
P2PE Solutions that are red for more than 90 days will be moved to PCI's list of Point-to-Point Encryption Solutions with Expired Validations. Expired P2PE solutions are no longer considered "validated" per the P2PE Program Guide and the validations are therefore expired. Refer to If a P2PE Solution is on PCI's list of Point-to-Point Encryption Solutions with Expired Validations, does the solution meet the eligibility criteria for SAQ P2PE? for more information.
SAQ P2PE is intended for SAQ-eligible merchants or merchant environments as determined by the individual payment card brands. Refer to Who can use SAQ P2PE? for more information.
September 2020
Article Number: 1484
Related
-
What are the expectations for entities when assigning risk rankings to vulnerabilities and resolving or addressing those vulnerabilities?
-
Is phishing-resistant authentication alone acceptable as multi-factor authentication for PCI DSS Requirements 8.4.1 and 8.4.3?
-
Are passkeys synced across devices, implemented according to the FIDO2 requirements, acceptable for use as phishing-resistant authentication to meet PCI DSS Requirement 8.4.2?
Featured FAQ Articles
Featured
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Is the PCI DSS Attestation of Compliance intended to be shared?
-
How does an entity report the results of a PCI DSS assessment for new requirements that are noted in PCI DSS as best practices until a future date?
-
Where do I direct questions about complying with PCI standards?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
Most Popular
-
What are the expectations for entities when assigning risk rankings to vulnerabilities and resolving or addressing those vulnerabilities?
-
Is phishing-resistant authentication alone acceptable as multi-factor authentication for PCI DSS Requirements 8.4.1 and 8.4.3?
-
Are passkeys synced across devices, implemented according to the FIDO2 requirements, acceptable for use as phishing-resistant authentication to meet PCI DSS Requirement 8.4.2?
-
How should PCI DSS v4.x requirements noted as superseded by another requirement be reported after 31 March 2025?
-
Are providers of third-party scripts for e-commerce environments considered third-party service providers for PCI DSS Requirements 12.8 and 12.9?
Most Recently Updated
-
How often must service providers test penetration testing segmentation controls under PCI DSS?
-
Are merchants allowed to request card-verification codes/values from cardholders?
-
What is the maximum period of time that cardholder data can be stored?
-
How can an entity ensure that hashed and truncated versions cannot be correlated?
-
Are point-of-interaction devices required to be physically secured (for example, with a cable or tether) to prevent removal or substitution to meet PCI DSS Requirement 9.5?