Do ISPs that provide only internet connection need to comply with the PCI DSS?
If the ISP only provides a "pipe" for internet access, then it is not considered a service provider and is not subject to PCI DSS compliance. However, if the ISP …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
Is frame relay considered a private network and are there any encryption requirements?
In general, frame relay can be considered private if it is dedicated to the customer's traffic. The PCI DSS requires encryption for transmission of cardholder data over public networks, not …
Should cardholder data be encrypted while in memory?Should cardholder data be encrypted while in memory?
| If the cardholder data is stored in non-persistent memory (e.g. RAM), encryption of cardholder data is not required. However, proper controls must … |
Is it required that all of a company's sites, even those located in other countries, must be included in the company's PCI DSS review?
The PCI DSS is a global standard and is applicable to all entities that process, transmit or store cardholder data regardless of geographic location. Each payment brand manages their PCI …
How does the PCI PA-DSS integrate with the PCI Data Security Standard (DSS)?
The requirements for Payment Application Data Security Standard (PA-DSS) are derived from the Payment Card Industry Data Security Standard (PCI DSS). This document details what is required for a merchant …
Where is the PCI Security Standards Council Located
The address for the PCI Security Standards Council is:
PCI Security Standards Council, LLC 401 Edgewater Place, Suite 600Wakefield, MA 01880
Are there any plans to standardize the reporting requirements (reports) for the PCI DSS, PA-DSS, ASV, QSA and PTS programs that are sent to each of the payment brands?
The PCI Security Standards Council (PCI SSC) mission is to develop, maintain and build awareness around the standards and supporting programs. Additionally, the PCI SSC strives to ensure that implementing …
Does PCI DSS, PA-DSS, or PTS apply to ATMs?
PCI DSS applies to any entity that stores, processes, or transmits cardholder data, the Payment Application Data Security Standard (PA-DSS) applies to payment applications that store, process, or transmit cardholder …
Are audio/voice recordings permitted to contain sensitive authentication data?
PCI SSC FAQ's are designed to provide merchants, assessors, acquirers and other Council stakeholders with clear and timely guidance on PCI standards. They are a critical two way communication channel …
What is the difference between masking and truncation?
Masking is addressed in PCI DSS Requirement 3.3, whereas truncation is one of several options specified to meet PCI DSS Requirement 3.4. Masking and truncation are both methods of rendering …