Latest changes to PCI SSC frequently asked questions.
No. The PCI 3DS Attestation of Compliance (AOC) can only document a "Compliant" finding if all requirements are tested and found to be "In Place" or a combination of "In …
No, an EMVCo Letter of Approval (LOA) is not required for a PCI 3DS Assessor to perform an assessment to the PCI 3DS Core Security Standard. If an EMVCo LOA …
Requirements P2-7.1 and P2-7.2, which relate to data center and CCTV security, apply to 3DS Directory Server (DS) and 3DS Access Control Server (ACS) systems. As noted in the Overview …
Yes, a 3DS entity may choose to outsource the hosting and management of its HSM infrastructure to a third-party service provider as long as all applicable requirements are met. The …
No. The "Compliant but with Legal exception" option in Part 3 of an Attestation of Compliance (AOC) allows an entity to document that they could not implement one or more …
An initial assessment is an entity's first formal PCI DSS assessment that results in the submission of a compliance validation document. Examples of validation documents include an Attestation of Compliance …
No, they are no longer considered validated. However, please contact the payment brands regarding the use of P2PE Solutions on the P2PE Expired List (How do I contact the …
Yes, P2PE solutions with dates shown as red or orange are considered validated P2PE solutions and meet the eligibility criteria for SAQ P2PE. Dates shown in colors on the PCI …
P2PE solutions on the PCI list of Point-to-Point Encryption Solutions with Expired Validations are no longer considered "validated" per the P2PE Program Guide. Because these P2PE solution providers did not …
SAQ P2PE is intended for SAQ-eligible merchants or merchant environments (as determined by the individual payment card brands), that process cardholder data only via a validated PCI-listed P2PE solution. Whether …
