Frequently Asked Question
Does PCI SSC endorse specific products to meet PCI DSS requirements?
PCI SSC does not endorse or approve specific security products, such as firewalls, anti-virus software, or web application firewalls, that may be used to help meet PCI DSS requirements. Wherever such products are used to meet PCI DSS requirements, they must be able to meet the specified requirements in full, as well as other applicable PCI DSS requirements (for example, authentication of users and administrative personnel, audit logging, etc.).
Since PCI SSC is not present to assess different environments, we cannot determine whether implementations of specific solutions or products meet PCI DSS requirements. For information on how PCI DSS applies to a specific solution or product implementation, please consult with a Qualified Security Assessor for assistance.
It should be noted that no single product can provide PCI DSS compliance or replace the need for organizations to validate their PCI DSS compliance. Organizations should consult with their acquirer (merchant bank) or the payment brands directly to understand their PCI DSS compliance obligations.
Since PCI SSC is not present to assess different environments, we cannot determine whether implementations of specific solutions or products meet PCI DSS requirements. For information on how PCI DSS applies to a specific solution or product implementation, please consult with a Qualified Security Assessor for assistance.
It should be noted that no single product can provide PCI DSS compliance or replace the need for organizations to validate their PCI DSS compliance. Organizations should consult with their acquirer (merchant bank) or the payment brands directly to understand their PCI DSS compliance obligations.
August 2013
Article Number: 1258
