Recent Updates RSS
The latest changes across PCI SSC resources and EMVCo specifications.
EMV Payment Tokenisation A Guide to Use Cases v2.3_DRAFT: Comment Period ends 1 May 2026
EMV® Level 3 (L3) Technical Bulletin n°321 - Comment period ends 16 April 2026
PO_Benefits_by_Tier
PCI_SSC_PPO_Flyer
Coffee with the Council Podcast: A Panel Discussion on Cryptography
Hello and welcome to our podcast series, Coffee with the Council. I'm Andrew Jamieson, VP, Distinguished Standards Architect for the PCI Security Standards Council. And I'll be your host …
Coffee with the Council Podcast: A Panel Discussion on Cryptography
Hello and welcome to our podcast series, Coffee with the Council. I'm Andrew Jamieson, VP, Distinguished Standards Architect for the PCI Security Standards Council. And I'll be your host …
2025CM_WorkshopSummary_VulnMgmt-PenTest_FINAL
2025CM_WorkshopSummary_DSS_FINAL
What happens if I'm using a PA-DSS validated payment application that is breached?
Events such as these should be accounted for in any service contract you sign with a software vendor. The Council requires that approved PA-QSAs carry appropriate liability insurance.
For the list of Validated PA-DSS Applications, what is the difference between Revalidation Date and Expiry Date?
Revalidation Date: Annually, the software vendor is required to revalidate by completing Part 3b of the Attestation of Validation form, confirming that no changes have been made to the application …
Are there any plans to standardize the reporting requirements (reports) for the PCI DSS, PA-DSS, ASV, QSA and PTS programs that are sent to each of the payment brands?
The PCI Security Standards Council (PCI SSC) mission is to develop, maintain and build awareness around the standards and supporting programs. Additionally, the PCI SSC strives to ensure that implementing …
What are the Card Production Logical and Physical Security Requirements?
The Card Production Logical and Physical Security Requirements were published by PCI SSC in 2013, and are intended to provide manufacturers and producers of payment cards with a comprehensive resource …
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
No. PCI DSS sensitive authentication data (SAD) consists of full magnetic-stripe data, card verification codes or values, and PINs or PIN blocks. PCI DSS specifically prohibits storage of SAD after …
Is sampling allowed in PCI DSS v4.x?
Yes. Assessors have two options when performing PCI DSS testing procedures; they can either: 1) test a representative sample of the population according to the assessor's defined sampling methodology, or …