What are the PA-DSS Expiry Dates?
The Expiry Date for PA-DSS Validated Payment Applications is the date by which a vendor must have the application reassessed against the current PA-DSS requirements in order for the application …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
When do I have to start using PCI DSS 3.0?
PCI DSS version 3.0 is effective from January 1st, 2014, and all entities should be working towards compliance with the latest PCI standards as soon as they are able. To …
When does PCI DSS version 2.0 expire?
PCI DSS version 2.0 expires on December 31st, 2014, and any PCI DSS 2.0 validations must be completed prior to this date. PCI DSS version 3.0 is effective from January …
Can my payment application be validated using PA-DSS Version 3.0 or 3.1?
New validations and High Impact Changes using PA-DSS v3.1 will be accepted until 31 August 2016. Low Impact and No Impact Changes to listed applications that were previously validated to …
Shared Passwords
Test FAQ
What is meant by "non-consumer users" in PCI DSS Requirement 8?
PCI DSS Requirement 8 addresses secure authentication requirements and requires that all passwords and other authentication credentials be securely managed. These requirements apply to all non-consumer users and administrators. The …
How much will it cost for a vendor to have their products validated to PA-DSS by a PA-QSA?
Fees for validation services are set independently by the PA-QSAs.
What will be the role of the PCI Security Standards Council in expanding the global coverage of both QSAs and ASVs?
The PCI Security Standards Council will make reasonable efforts to evaluate global coverage for both QSAs and ASVs, and will attempt to identify and encourage participation by qualified parties to …
Who is qualified to perform PA-DSS assessments?
Payment Application Qualified Security Assessors (PA-QSAs) are qualified by the Council to validate payment applications for compliance to PA-DSS. A list of PA-QSAs is available on the Council website. A …
Is "two-step" authentication the same as "two-factor" or "multi-factor" authentication?
?Two-step" or "multi-step" authentication is not the same as "two-factor" or "multi-factor". "Two-step" or "multi-step" authentication involves the subsequent presentation of one or more authentication steps after the first authentication …