Frequently Asked Questions
Featured FAQ Articles
Featured
-
How does an e-commerce merchant meet the SAQ A eligibility criteria for scripts?
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Is the PCI DSS Attestation of Compliance intended to be shared?
-
How does an entity report the results of a PCI DSS assessment for new requirements that are noted in PCI DSS as best practices until a future date?
-
Where do I direct questions about complying with PCI standards?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
Most Popular
-
What is the completion date for PCI DSS assessments documented in a Self-Assessment Questionnaire and its related Attestations of Compliance?
-
Does a QSA need to be onsite at the client's premises for all aspects of a PCI DSS assessment?
-
If a merchant has multiple processing environments, should the merchant complete multiple SAQ to validate their PCI DSS compliance?
-
What type of assessor signatures are allowable for PCI SSC attestation documentation?
-
Is sampling allowed in PCI DSS v4.x?
Most Recently Updated
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Is sampling allowed in PCI DSS v4.x?
-
How does PCI DSS apply to payment terminals?
-
How does encrypted cardholder data impact PCI DSS scope?
-
How does encrypted cardholder data impact PCI DSS scope for third-party service providers?
Featured FAQ Articles
Featured
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Should entities with enterprise or internal service providers, used to provide internal services to other corporate entities, conduct separate PCI DSS assessments of these service providers or include them as part of each corporate entity’s PCI DSS assessment?
-
What is the impact if an entity uses a third-party service provider (TPSP) to meet a PCI DSS requirement(s), when that TPSP’s PCI DSS assessment completion date is close to a year ago, as documented in the TPSP’s Attestation of Compliance (AOC)?
-
Are Approved Scanning Vendors and Qualified Security Assessors considered third-party service providers for PCI DSS Requirements 12.8 and 12.9?
-
What are the expectations for entities when assigning risk rankings to vulnerabilities and resolving or addressing those vulnerabilities?
Most Popular
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Should entities with enterprise or internal service providers, used to provide internal services to other corporate entities, conduct separate PCI DSS assessments of these service providers or include them as part of each corporate entity’s PCI DSS assessment?
-
What is the impact if an entity uses a third-party service provider (TPSP) to meet a PCI DSS requirement(s), when that TPSP’s PCI DSS assessment completion date is close to a year ago, as documented in the TPSP’s Attestation of Compliance (AOC)?
-
Are Approved Scanning Vendors and Qualified Security Assessors considered third-party service providers for PCI DSS Requirements 12.8 and 12.9?
-
What are the expectations for entities when assigning risk rankings to vulnerabilities and resolving or addressing those vulnerabilities?