Recent FAQ Changes RSS

Each payment brand determines their own compliance validation requirements, which may include specific requirements for companies comprised of multiple or separate entities. Organizations should contact their acquirer (merchant bank) and/or …

It is recommended that you discuss any concerns you have with the merchant in question. In many cases, once merchants have become aware of issues identified to them by their …

PCI DSS does not define minimum or maximum times for which cardholder data may be stored. PCI DSS Requirement 3.1 specifies that a data retention and disposal policy must be …

Yes. These values are typically used for card-not-present (CNP) transactions, where the card is not physically present at the merchant location (for example, during e-commerce or mail order/telephone order transactions). …

PCI DSS Requirements 11.2 and 11.3 address internal and external vulnerability scans and penetration testing respectively, including that they need to be performed after a significant change to the environment. …

SAQ B-IP is intended for merchants who use PCI PTS-approved point-of-interaction (POI) devices that communicate to the payment processor over an IP-based (Internet Protocol) network. The list of PTS-approved devices …