Are merchants allowed to request card-verification codes/values from cardholders?
→
Reinstated FAQs
38 FAQs have been deleted from the PCI SSC website and later restored.
What changes are PFI companies allowed to make to the PFI Reporting Templates?
→
Why do requirements 8.3.9 and 8.3.10.1 focus on passwords/passphrases used for single-factor authentication, when multi-factor authentication is required for all access into the CDE?
→
Are administrators allowed to share passwords?
→
Are point-of-sale devices required to be physically secured (e.g. with a cable or tether) to prevent removal or substitution in order to meet PCI DSS Requirement 9.9?
→
PCI DSS provides a common data security standard across all payment brands. Are there any plans to provide a common structure of penalties and/or fines for non-compliance to this standard?
→
Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?
→
What should a merchant do if cardholder data is accidentally received via an unintended channel?
→