Frequently Asked Question
What assurances does the Council provide regarding the quality of organizations assessing my systems for compliance with the PCI standards?
The PCI Security Standards Council (PCI SSC) maintains lists of qualified assessors and has implemented a quality assurance program to ensure that services provided by qualified assessors are of an appropriate level. Completion of in-depth training programs and annual re-certifications is required for security companies seeking to become qualified assessors. Details of our training programs can be found on our Website.
Our list of qualified assessors can be found at: https://www.pcisecuritystandards.org/approved_companies_providers/index.php
Our list of qualified assessors can be found at: https://www.pcisecuritystandards.org/approved_companies_providers/index.php
November 2012
Article Number: 1168
Related
-
Do ASV scans in SAQ A apply to merchants with webpages that redirect to TPSPs or include TPSPs’ embedded iframes?
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Should entities with enterprise or internal service providers, used to provide internal services to other corporate entities, conduct separate PCI DSS assessments of these service providers or include them as part of each corporate entity’s PCI DSS assessment?
Featured FAQ Articles
Featured
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Is the PCI DSS Attestation of Compliance intended to be shared?
-
How does an entity report the results of a PCI DSS assessment for new requirements that are noted in PCI DSS as best practices until a future date?
-
Where do I direct questions about complying with PCI standards?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
Most Popular
-
What are acceptable formats for truncation of primary account numbers?
-
For PCI DSS, why is storage of sensitive authentication data (SAD) after authorization not permitted even when there are no primary account numbers (PANs) in an environment?
-
How does an e-commerce merchant meet the SAQ A eligibility criteria for scripts?
-
If an organization provides software or functionality that runs on a consumer's device (for example, smartphones, tablets, or laptops) and is used to accept payment account data, can the organization store card verification codes for those consumers?
-
Are truncated Primary Account Numbers (PAN) required to be protected in accordance with PCI DSS?
Most Recently Updated
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
-
Does PCI DSS define which versions of TLS must be used?
-
Do ASV scans in SAQ A apply to merchants with webpages that redirect to TPSPs or include TPSPs’ embedded iframes?
-
Is sampling allowed in PCI DSS v4.x?