How does PCI DSS apply to EMVCo Payment Tokens?
Payment Tokens, as defined by EMVCo in the "EMVCo Payment Tokenisation Specification - Technical Framework", are provided to merchants and acquirers in lieu of the cardholder's PAN. They …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
How do I contact the payment card brands?
Contact details for the payment brands are provided below:
American Express
- Website: www.americanexpress.com/datasecurity
- Email: AmericanExpressCompliance@trustwave.com
Discover
- Website: http://www.discovernetwork.com/merchants/data-security/index.html - For questions about the …
How do I contact the payment card brands?
Contact details for the payment brands are provided below:
American Express
- Website: www.americanexpress.com/datasecurity
- Email: AmericanExpressCompliance@trustwave.com
Discover
- Website: http://www.discovernetwork.com/merchants/data-security/index.html
- For questions about …
How do I contact the payment card brands?
Contact details for the payment brands are provided below:
American Express
- Website: http://www.americanexpress.com/datasecurity
- Email: AmericanExpressCompliance@trustwave.com
Discover
- Website: http://www.discovernetwork.com/merchants/data-security/index.html
- For questions …
How do I contact the payment card brands?
Contact details for the payment brands are provided below:
American Express
- Website: www.americanexpress.com/datasecurity
- Email: AmericanExpressCompliance@trustwave.com
Discover
- Website: http://www.discovernetwork.com/merchants/data-security/index.html - For questions about the …
Is there an exception to P2PE Requirement 2A-2.1 that a P2PE application can only export PAN or SAD encrypted by the firmware of the PCI-approved POI device, where there is a legal or regulatory obligation to print the full PAN on merchant receipts?
This is a Technical FAQ for P2PE versions 1.x. This is a "normative" FAQ that is considered to be part of the P2PE requirements and shall be considered during a …
For P2PE Requirement 2A-3, can a P2PE PCI-approved POI device have a "separation layer" that is assessed once in a P2PE assessment and thereafter relied upon to exclude from review those applications on the device with no access to cardholder data?
This is a Technical FAQ for P2PE versions 1.x. This is a "normative" FAQ that is considered to be part of the P2PE requirements and shall be considered during a …
Is it expected that P2PE applications be assessed per Domain 2 requirements (for example, 2A-1.2.c) if forensics tools are not effective due to architectural constraints of the POI device?
This is a Technical FAQ for P2PE versions 1.x. This is a "normative" FAQ that is considered to be part of the P2PE requirements and shall be considered during a …
For P2PE Requirement 3B-5, is it the responsibility of the solution provider to "push" patches to all affected POI devices, or is it sufficient for them to make it available for download and advise the merchant how to download and install the patches?
This is a Technical FAQ for P2PE versions 1.x. This is a "normative" FAQ that is considered to be part of the P2PE requirements and shall be considered during a …
Must SRED devices leave the deployment facility in an already-encrypting state? In lieu of this, can a solution provider use a tool or method to monitor and alert if any unencrypted transactions are received?
This is a Technical FAQ for P2PE versions 1.x. This is a "normative" FAQ that is considered to be part of the P2PE requirements and shall be considered during a …