Frequently Asked Question
Is an assessor required to visit work-from-home environments to determine if personnel are meeting PCI DSS requirements?
No, PCI SSC does not require QSAs or ISAs to visit personnel private residences for any purpose, including the review of work-from-home (WFH) environments to validate PCI DSS requirements.
Entities should have policies and procedures implemented to provide assurance that applicable PCI DSS controls are in place for WFH personnel and that such personnel are aware of and adhering to the entity's secure practices.
Assessors should work with the entity to understand the processes and controls the entity has implemented to secure connections from personnel in WFH environments. This includes understanding how the entity ensures that account data is stored, processed, or transmitted from WFH environments in accordance with applicable PCI DSS requirements, and how the entity gains assurance that those controls continue to function effectively to protect the entity's network and cardholder data.
See also the following FAQs:
FAQ 1494: For personnel working from home, is the work-from-home environment considered a "sensitive area" for PCI DSS Requirement 9?
FAQ 1496: Are entities expected to do onsite audits of personnel work-from-home environments?
