Frequently Asked Question
If a P2PE Solution is shown as red or orange on PCI's list of Validated P2PE Solutions, does the solution meet the eligibility criteria for SAQ P2PE?
Yes, P2PE solutions with dates shown as red or orange are considered validated P2PE solutions and meet the eligibility criteria for SAQ P2PE. Dates shown in colors on the PCI SSC list of Validated P2PE Solutions indicate that the solution has not been revalidated in accordance with P2PE program requirements. Orange means that the P2PE Solution revalidation is up to 90 days overdue and red means that the P2PE Solution revalidation is more than 90 days overdue. These colors and their meaning are described at the bottom of each listings page and are defined in the P2PE Program Guide.
P2PE Solutions that are red for more than 90 days will be moved to PCI's list of Point-to-Point Encryption Solutions with Expired Validations. Expired P2PE solutions are no longer considered "validated" per the P2PE Program Guide and the validations are therefore expired. Refer to If a P2PE Solution is on PCI's list of Point-to-Point Encryption Solutions with Expired Validations, does the solution meet the eligibility criteria for SAQ P2PE? for more information.
SAQ P2PE is intended for SAQ-eligible merchants or merchant environments as determined by the individual payment card brands. Refer to Who can use SAQ P2PE? for more information.
P2PE Solutions that are red for more than 90 days will be moved to PCI's list of Point-to-Point Encryption Solutions with Expired Validations. Expired P2PE solutions are no longer considered "validated" per the P2PE Program Guide and the validations are therefore expired. Refer to If a P2PE Solution is on PCI's list of Point-to-Point Encryption Solutions with Expired Validations, does the solution meet the eligibility criteria for SAQ P2PE? for more information.
SAQ P2PE is intended for SAQ-eligible merchants or merchant environments as determined by the individual payment card brands. Refer to Who can use SAQ P2PE? for more information.
September 2020
Article Number: 1484
Related
-
Do ASV scans in SAQ A apply to merchants with webpages that redirect to TPSPs or include TPSPs’ embedded iframes?
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Should entities with enterprise or internal service providers, used to provide internal services to other corporate entities, conduct separate PCI DSS assessments of these service providers or include them as part of each corporate entity’s PCI DSS assessment?
Featured FAQ Articles
Featured
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Is the PCI DSS Attestation of Compliance intended to be shared?
-
How does an entity report the results of a PCI DSS assessment for new requirements that are noted in PCI DSS as best practices until a future date?
-
Where do I direct questions about complying with PCI standards?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
Most Popular
-
What are acceptable formats for truncation of primary account numbers?
-
For PCI DSS, why is storage of sensitive authentication data (SAD) after authorization not permitted even when there are no primary account numbers (PANs) in an environment?
-
How does an e-commerce merchant meet the SAQ A eligibility criteria for scripts?
-
If an organization provides software or functionality that runs on a consumer's device (for example, smartphones, tablets, or laptops) and is used to accept payment account data, can the organization store card verification codes for those consumers?
-
Are truncated Primary Account Numbers (PAN) required to be protected in accordance with PCI DSS?
Most Recently Updated
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
-
Does PCI DSS define which versions of TLS must be used?
-
Do ASV scans in SAQ A apply to merchants with webpages that redirect to TPSPs or include TPSPs’ embedded iframes?
-
Is sampling allowed in PCI DSS v4.x?