ℹ️
Reference Content: This is a copy of content from the PCI Security Standards Council FAQ database, preserved for tracking changes over time.
View Original →
FAQ #1258 Published

Does PCI SSC endorse specific products to meet PCI DSS requirements?

PCI SSC does not endorse or approve specific security products, such as firewalls, anti-virus software, or web application firewalls, that may be used to help meet PCI DSS requirements. Wherever such products are used to meet PCI DSS requirements, they must be able to meet the specified requirements in full, as well as other applicable PCI DSS requirements (for example, authentication of users and administrative personnel, audit logging, etc.).Since PCI SSC is not present to assess different environments, we cannot determine whether implementations of specific solutions or products meet PCI DSS requirements. For information on how PCI DSS applies to a specific solution or product implementation, please consult with a Qualified Security Assessor for assistance.It should be noted that no single product can provide PCI DSS compliance or replace the need for organizations to validate their PCI DSS compliance.  Organizations should consult with their acquirer (merchant bank) or the payment brands directly to understand their PCI DSS compliance obligations.

Disclaimer: This FAQ has been processed for display on this website and may contain errors. Please check the original FAQ on the PCI SSC website for the authoritative version.