Does the Prioritized Approach replace the PCI DSS?
The Prioritized Approach is not a replacement for PCI DSS; rather, it reorganizes the PCI DSS requirements into security milestones, and is designed to help organizations working towards PCI DSS …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
How frequently will the PCI Security Standards Council update the PCI DSS and PA-DSS?
To minimize changes to the standards, the PCI Security Standards Council (PCI SSC) has established a lifecycle approach for PCI DSS and PA-DSS, where version changes to the standards will …
How can I validate if a number is a legitimate credit card number?
The Luhn formula or Modulus 10 is the algorithm most often used to validate Primary Account Numbers (PAN). The algorithm works as follows: 1. double the value of alternate digits …
Do shared hosting providers need to comply with PCI DSS?
PCI DSS requirement 2.4 and appendix A: "PCI DSS applicability for hosting providers" is applicable to all shared hosting providers whose customers store, process, or transmit cardholder data. A shared …
Does cardholder name, expiration date, etc. need to be rendered unreadable if stored in conjunction with the PAN (Primary Account Number)?
For PCI DSS requirement 3.4 and protection of specific cardholder data elements, please refer to the table included in the PCI DSS on page 2 (www.pcisecuritystandards.org). The table …
Can you provide clarification of PCI DSS requirement 10.3.6?
The intent of PCI DSS requirement 10.3.6 is to provide the ability for an organization to identify the data, systems, or components affected when an unauthorized access attempt is being, …
Can you provide clarification for logging/audit trail per PCI DSS requirements 10.2.5 and 10.2.6?
PCI DSS requirement 10.2.5 requires organizations to log the use of identification and authentication mechanisms, which are typically used by administrators. These mechanisms include (but are not limited to activities …
Can the full payment card number be printed on the consumer's copy of the receipt?
PCI DSS requirement 3.3 states “Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed).” See also the note under …
Can you define what is meant by system-level objects in PCI DSS requirement 10.2.7?
A system-level object is anything on a computer system required for its operation, including but not limited to application executable and configuration files, system configuration files, static and shared libraries …
Can VLANS be used for network segmentation?
In general, implementing adequate network segmentation can reduce the scope of the PCI DSS assessment if it isolates systems that store, process, or transmit cardholder data from other systems. While …