Are remote assessments permitted for PCI DSS?
While onsite assessments continue to be the expected method for PCI SSC assessments, the use of remote assessment methods may provide a suitable alternative in legitimate scenarios where an onsite …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
What is a compliance-accepting entity?
When assessment results are associated with compliance programs defined and managed by one or more payment brands, the compliance-accepting entity is the entity to which those assessment results (for example, …
What is the difference between masking and truncation?
Masking is addressed in PCI DSS Requirement 3.3, whereas truncation is one of several options specified to meet PCI DSS Requirement 3.4.
Requirement 3.3 relates to protection of PAN …
Are truncated Primary Account Numbers (PAN) required to be protected in accordance with PCI DSS?
Systems that store, process, or transmit only truncated PANs (where a segment of PAN data has been permanently removed) may be considered out of scope for PCI DSS if those …
How does an organization maintain compliance when a standard changes?
PCI SSC updates its standards to address changes in payment industry threats, risks, and best practices. To ensure organizations have enough time to transition to a new standard, the previous …
What are acceptable formats for truncation of primary account numbers?
This update includes minor clarifications about acceptable PAN / BIN lengths, as follows:
- Adds UnionPay's PAN / BIN formats to the table.
- Reformats the table included in …
For PCI DSS, why is storage of sensitive authentication data (SAD) after authorization not permitted even when there are no primary account numbers (PANs) in an environment?
In the PCI DSS Applicability Information section of the standard, it is stated that sensitive authentication data must not be stored after authorization even if encrypted, and that this applies …
For personnel working from home, is the work-from-home environment considered a "sensitive area" for PCI DSS Requirement 9?
No. An individual's private work-from-home (WFH) environment is not considered a "sensitive area," and personnel working from home are not required to meet PCI DSS Requirements 9.1.1 or 9.3 for …
Is an assessor required to visit work-from-home environments to determine if personnel are meeting PCI DSS requirements?
No, PCI SSC does not require QSAs or ISAs to visit personnel private residences for any purpose, including the review of work-from-home (WFH) environments to validate PCI DSS requirements. Entities …
Are entities expected to do onsite audits of personnel work-from-home environments?
No, entities are not expected to conduct onsite assessments of work-from-home (WFH) environments, as home environments are not owned or controlled by the entity. Entities are expected to have controls …