Frequently Asked Question
What are the PA-DSS Expiry Dates?
The Expiry Date for PA-DSS Validated Payment Applications is the date by which a vendor must have the application reassessed against the current PA-DSS requirements in order for the application to remain listed as "Acceptable for New Deployments" on the PCI SSC website.
PA-DSS expiry dates are as follows:
PA-DSS version | Expiry of application listing |
1.0 | 28 October, 2013 |
2.0 | 28 October, 2016 |
3.0 | 28 October, 2019 |
3.1 | 28 October, 2019 |
3.2 | 28 October, 2022 |
After the Expiry Date, applications are listed as 'Acceptable only for Pre-Existing Deployments.' See FAQ #1195 for an explanation of the difference between an application which is "Acceptable for New Deployments" and one which is 'Acceptable only for Pre-Existing Deployments.'
Last updated: June 2015
Posted at: December 2013
Posted at: December 2013
Article Number: 1275
Related
-
What evidence is a TPSP expected to provide to customers to demonstrate PCI DSS compliance?
-
Does PCI SSC consider guidance from other standards organizations when making updates to PCI standards?
-
If an organization provides software or functionality that runs on a consumer's device (for example, smartphones, tablets, or laptops) and is used to accept payment account data, can the organization store card verification codes for those consumers?
Featured FAQ Articles
Featured
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Is the PCI DSS Attestation of Compliance intended to be shared?
-
How does an entity report the results of a PCI DSS assessment for new requirements that are noted in PCI DSS as best practices until a future date?
-
Where do I direct questions about complying with PCI standards?
-
Can SAQ eligibility criteria be used for determining applicability of PCI DSS requirements for assessments documented in a Report on Compliance?
Most Popular
-
What evidence is a TPSP expected to provide to customers to demonstrate PCI DSS compliance?
-
Does PCI SSC consider guidance from other standards organizations when making updates to PCI standards?
-
If an organization provides software or functionality that runs on a consumer's device (for example, smartphones, tablets, or laptops) and is used to accept payment account data, can the organization store card verification codes for those consumers?
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Can a compensating control be used for requirements with a periodic or defined frequency, where an entity did not perform the activity within the required timeframe?