Latest changes to PCI SSC frequently asked questions.
Systems that store, process, or transmit only truncated PANs (where a segment of PAN data has been permanently removed) may be considered out of scope for PCI DSS if those …
PCI SSC updates its standards to address changes in payment industry threats, risks, and best practices. To ensure organizations have enough time to transition to a new standard, the previous …
This update includes minor clarifications about acceptable PAN / BIN lengths, as follows:
In the PCI DSS Applicability Information section of the standard, it is stated that sensitive authentication data must not be stored after authorization even if encrypted, and that this applies …
No. An individual's private work-from-home (WFH) environment is not considered a "sensitive area," and personnel working from home are not required to meet PCI DSS Requirements 9.1.1 or 9.3 for …
No, PCI SSC does not require QSAs or ISAs to visit personnel private residences for any purpose, including the review of work-from-home (WFH) environments to validate PCI DSS requirements. Entities …
No, entities are not expected to conduct onsite assessments of work-from-home (WFH) environments, as home environments are not owned or controlled by the entity. Entities are expected to have controls …
The PCI SSC document library contains an overview that answers numerous questions about the PCI 3DS Core Security Standard (otherwise known as the PCI 3DS Security Requirements and Assessment Procedures …
There are two PCI DSS requirements that may be affected when considering 8-digit BINs. Requirement 3.3 pertains to masking (concealing) digits of the PAN so that the full PAN is …
No. However, PCI DSS does not consider SSL or early TLS to be strong cryptography. Transport Layer Security (TLS) is a protocol that encrypts traffic between two endpoints to provide …
