Frequently Asked Question

This FAQ is intended for entities that need to complete a ROC or SAQ for PCI DSS v3.1 using the updated SSL/early TLS migration dates for Requirements 2.2.3, 2.3 and 4.1.

If using a ROC, the following guidance affects Testing Procedures 2.2.3.c, 2.3.f, and 4.1.i:

• Document the entity's target migration completion date (as provided in their Risk Mitigation and Migration Plan) in the "Reporting Details: Assessor's Response" column for the applicable testing procedures.
• If the entity's completion date is no later than June 30, 2016, and all other elements of the requirement are met, the assessor may check the "In Place" option for that requirement.
• If the entity's completion date falls between June 30, 2016 and June 30, 2018, and all other elements of the requirement are met, the assessor may check the "In Place w/CCW" option for that requirement, and complete a Compensating Control Worksheet (CCW).  A CCW is provided in Appendix C of the ROC Reporting Template.  In the CCW, document in Section 4 ('Definition of Compensating Controls') that the entity's Risk Mitigation and Migration Plan meets the revised migration deadline date as announced by PCI SSC in December 2015.    
• If the entity's completion date is later than June 30, 2018, the assessor may check the "Not in Place" option for that requirement.

If using a SAQ, the following guidance affects Questions 2.2.3, 2.3.f, and 4.1.g:

• If the entity's completion date is no later than June 30, 2016, and all other elements of the question are met, check the "Yes" option for that question.
• If the entity's completion date falls between June 30, 2016 and June 30, 2018, and all other elements of the question are met, check the "Yes with CCW" option for that question, and complete a Compensating Control Worksheet (CCW).  A CCW is provided in Appendix B of the SAQ.  In the CCW, document in Section 4 ('Definition of Compensating Controls') that the entity's Risk Mitigation and Migration Plan meets the revised migration deadline date as announced by PCI SSC in December 2015.    
• If the entity's completion date is later than June 30, 2018, check the "No" option for that question.

Entities should always contact their acquirer or the payment brands directly to confirm their compliance reporting requirements. Contact details for the payment brands can be found in How do I contact the payment card brands?

For additional guidance, refer to How should entities apply the new SSL/TLS migration dates to Requirements 2.2.3, 2.3 and 4.1 for PCI DSS v3.1?