When do I have to start using PCI DSS 3.0?
PCI DSS version 3.0 is effective from January 1st, 2014, and all entities should be working towards compliance with the latest PCI standards as soon as they are able. To …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
I'm in the middle of a PCI DSS 2.0 assessment — should I start again on version 3.0 or keep going with version 2.0?
Organizations that have already begun their validation to PCI DSS 2.0, and have not yet fully adopted the new version can complete their assessment and validation process to version 2.0 …
Can I combine sections from PCI DSS version 2.0 and 3.0?
When validating compliance, either through a Report on Compliance (ROC) or a self-assessment questionnaire (SAQ), requirements should not be ?combined? from the two versions of the standard ? validation will …
What are the PA-DSS Expiry Dates?
The Expiry Date for PA-DSS Validated Payment Applications is the date by which a vendor must have the application reassessed against the current PA-DSS requirements in order for the application …
When will ROVs for a payment application under PA-DSS version 2.0 no longer be accepted?
New application validations using PA-DSS 2.0 will be accepted until December 31st, 2014. Changes to applications validated using PA-DSS 2.0 will be accepted until October 28th, 2016. Beginning January 1st …
When can I submit a ROV for a payment application under PA-DSS version 3.0?
PA-DSS version 3.0 submissions will be accepted from January 2014 until December 31st, 2017. During 2014, PA-DSS submissions will be accepted for both PA-DSS 2.0 and PA-DSS 3.0 assessments.
Can I combine sections from PA-DSS 2.0 and 3.0?
No. When validating payment application compliance through a Report on Validation (ROV) you may not ‘combine’ requirements from the two versions of the standard — your assessment must be to …
How do the requirements in PCI DSS version 3 that are "best practices" until June 30th 2015 impact my PCI DSS assessment?
In PCI DSS version 3, Requirements 6.5.10, 8.5.1, 9.9, 11.3, and 12.9 are considered "best practices" until June 30th, 2015, after which they become requirements. This is intended to give …
When can I start using version 3.0 of the SAQs?
Version 3 of the self-assessment questionnaires (SAQs) are used to validate compliance against PCI DSS version 3, which is effective from January 1st, 2014. The PCI SSC strongly encourages all …
When does PCI DSS version 2.0 expire?
PCI DSS version 2.0 expires on December 31st, 2014, and any PCI DSS 2.0 validations must be completed prior to this date. PCI DSS version 3.0 is effective from January …