What is the definition of "remote access"?
PCI DSS requirement 8.3 is intended to apply to users that have remote access to the network, where that remote access could lead to access to the cardholder data environment. …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
I'm a small merchant who has limited payment card transaction volume. Do I need to be compliant with PCI DSS? If so, what is the deadline?
All merchants, whether small or large, need to be PCI compliant. The payment brands have collectively adopted PCI DSS as the requirement for organizations that process, store or transmit payment …
Who are the founders of the PCI Security Standards Council?
The founders of the PCI Security Standards Council are American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa Inc.
What is the role of the Advisory Board?
The role of the Advisory Board will be to provide strategic and technical guidance to the PCI Security Standards Council, reflecting different stakeholder perspectives. The Advisory Board does not have …
How does an organization maintain compliance when a standard changes?
To minimize changes to the standards, the PCI Security Standards Council (PCI SSC) has established a lifecycle approach for PCI DSS and PA-DSS, where major version changes to the standards …
How does PA-DSS support a merchant's PCI DSS compliance?
Traditional PCI DSS compliance may not apply to payment application vendors since most vendors do not store, process, or transmit cardholder data. However, because these payment applications are used by …
Is IDS required if centralized log correlation is in place?
Although log correlation can be a valuable tool in a company's information security strategy, it is not a replacement for an intrusion detection system. The IDS wording in PCI DSS …
What are the requirements under PCI DSS with respect to transmission of cardholder data via Bluetooth technology?
The PCI DSS requirement 4.1 states "use strong cryptography and security protocols such as SSL / TLS/ IPSEC to safeguard sensitive cardholder data during transmission over open, public networks.? While …
What is the purpose of requiring account lockout, per PCI DSS requirement 8.5.14?
The intent of PCI DSS requirement 8.5.14 is to lock out accounts due to suspicious activity, to prevent a malicious user from gaining access to users’ accounts, by continually trying …
Can the full credit card number be displayed within a browser window?
PCI DSS requirement 3.3 requires that the PAN be masked when it is displayed (for example, on screens, logs, reports, receipts), unless the viewing party has a specific need to …