Do ISPs that provide only internet connection need to comply with the PCI DSS?
If the ISP only provides a "pipe" for internet access, then it is not considered a service provider and is not subject to PCI DSS compliance. However, if the ISP …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
If a merchant or service provider has internal corporate credit cards used by employees for company purchases like travel or office supplies, are these corporate cards considered "in scope" for PCI DSS?
PCI DSS applies to any entity that stores, processes, or transmits cardholder data. Whether entities with cardholder data on their own corporate cards need to validate compliance is determined by …
Are truncated Primary Account Numbers (PAN) required to be protected in accordance with PCI DSS?
Systems that store only truncated PANs (where a segment of PAN data has been permanently removed) may be considered out of scope for PCI DSS if that system is adequately …
Is MPLS considered a private or public network when transmitting cardholder data?
In general, MPLS networks are considered "private" networks and do not require encryption. This, however, is dependent upon the specific provider and/or configuration. If the IP addresses are public and …
Is the Prioritized Approach mandatory?
The PCI SSC does not mandate the use of any one approach to PCI DSS compliance. The Prioritized Approach is designed as a reporting tool to help entities understand where …
How does the Prioritized Approach work?
The Prioritized Approach tool is intended to help guide non-compliant entities to work through the process of becoming PCI DSS compliant. The Prioritized Approach does not supersede or replace the …
Should I complete the Prioritized Approach milestones in sequential order?
The Prioritized Approach was developed to address the highest common risks first in Milestone 1, the next highest risks in Milestone 2, etc. The Prioritized Approach provides a means to …
Does the Prioritized Approach replace the PCI DSS?
The Prioritized Approach is not a replacement for PCI DSS; rather, it reorganizes the PCI DSS requirements into security milestones, and is designed to help organizations working towards PCI DSS …
How frequently will the PCI Security Standards Council update the PCI DSS and PA-DSS?
To minimize changes to the standards, the PCI Security Standards Council (PCI SSC) has established a lifecycle approach for PCI DSS and PA-DSS, where version changes to the standards will …
How can I validate if a number is a legitimate credit card number?
The Luhn formula or Modulus 10 is the algorithm most often used to validate Primary Account Numbers (PAN). The algorithm works as follows: 1. double the value of alternate digits …