Are merchants required to meet PCI DSS Requirement 12.9?
PCI DSS Requirement 12.9 applies only if the entity being assessed is a service provider. Merchants and other entities that use service providers should review PCI DSS Requirement 12.8 and …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
How do I contact the payment card brands?
Contact details for the payment brands are provided below:
American Express
- Website: www.americanexpress.com/datasecurity
- Email: AmericanExpressCompliance@trustwave.com
Discover
- Website: http://www.discovernetwork.com/merchants/data-security/index.html
- For questions about …
How do I contact the payment card brands?
Contact details for the payment brands are provided below:
American Express
- Website: www.americanexpress.com/datasecurity
- Email: AmericanExpressCompliance@trustwave.com
Discover
- Website: http://www.discovernetwork.com/merchants/data-security/index.html - For questions about the …
How do I contact the payment card brands?
Contact details for the payment brands are provided below:
American Express
- Website: www.americanexpress.com/datasecurity
- Email: AmericanExpressCompliance@trustwave.com
Discover
- Website: http://www.discovernetwork.com/merchants/data-security/index.html - For questions about the …
Why is SAQ A-EP used for Direct Post while SAQ A is used for iFrame or URL redirect?
There is a distinct difference in terms of payment acceptance between Direct Post & iFrames/redirects, which is why there are different SAQs. In a Direct Post implementation, the merchant website …
Why does PA-DSS v3.0 require passwords to be protected by a one-way hash (Requirement 3.3.2), whereas PANs can be stored in an encrypted form (Requirement 2.3)?
A payment application is required to restrict administrative access and access to cardholder data to authenticated (Requirement 3.1.4), authorized (Requirement 3.1) users. Where users authenticate to the payment application using …
Does PA-DSS Requirement 3.3.2 apply to passwords used by the payment application to access other systems/applications (e.g. for the payment application to access a third-party database)?
PA-DSS Requirement 3.3.2 applies to all passwords generated or managed by the payment application that are used to authenticate access to the payment application. This requirement is not intended to …
Does the PA-DSS v3.0 requirement for hashing stored passwords meet PCI DSS Requirement 8.2.1?
Yes; PA-DSS v3.0 requires that a strong, one-way cryptographic algorithm with a unique input variable be used to render all payment application passwords unreadable during storage. This meets the intent …
If a merchant uses a service provider to host part or all of their CDE, and the service provider has been validated as PCI DSS compliant, is the merchant's assessor required to go onsite to the third party location and retest the PCI DSS requirements?
PCI SSC does not require that an entity's assessor go onsite to the entity's service providers and retest PCI DSS requirements that have already been validated and are covered under …
If a merchant develops an application that runs on a consumer's device (e.g. smartphone, tablet, or laptop) that is used to accept payment card data, what are the merchant's obligations regarding PCI DSS and PA-DSS for that application?
If the consumer is also the cardholder and is using the device solely for his/her own cardholder data entry, and the application can only be used by that cardholder using …