What is the meaning of 'initial PCI DSS assessment'?
Where an entity is being assessed for the first time against a PCI DSS requirement with a defined timeframe, it is considered an initial PCI DSS assessment for that requirement. …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
Yes, a PFI Final Report is required. The expectation is that the PFI must complete the merchant's PFI Investigation and produce the PFI Final Report, with details of adequate evidence …
Which PCI standards apply to card manufacturers, embossers, card personalizers, or entities that prepare data for card manufacturing?
Organizations that participate in data preparation, manufacturing, personalizing, and/or embossing for plastic cards are considered Card Production Vendors and are typically required to adhere to the Card Production and Provisioning …
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
Yes, a PFI Final Report is required. The expectation is that the PFI must complete the merchant's PFI Investigation and produce the PFI Final Report, with details of adequate evidence …
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
Yes, a PFI Final Report is required. The expectation is that the PFI must complete the merchant’s PFI Investigation and produce the Final PFI Report, with details of adequate evidence …
What is meant by "at risk" and "at-risk timeframe" referenced in the Final PFI Report?
When completing the spreadsheet referenced within the Final PFI Report under Appendix C: Impacted Entities, an account is considered "at risk" if evidence indicates the account number was exposed (i.e. …
Does PCI SSC consider guidance from other standards organizations when making updates to PCI standards?
Yes. PCI SSC considers the guidance provided from many different standards organizations when updating our standards, balancing the guidance against the unique needs and challenges of the payments industry.There may …
Does PCI SSC consider guidance from other standards organizations when making updates to PCI standards?
Yes. PCI SSC considers the guidance provided from many different standards organizations when updating our standards, balancing the guidance against the unique needs and challenges of the payments industry.
…
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
Yes, a PFI Final Report is required. The expectation is that the PFI must complete the merchant’s PFI Investigation and produce the Final PFI Report, with details of adequate evidence …
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
Yes, a PFI Final Report is required. The expectation is that the PFI must complete the merchant's PFI Investigation and produce the PFI Final Report, with details of adequate evidence …