What are acceptable formats for masking of primary account numbers (PAN)?
PCI DSS Requirement 3.3 specifies that PAN is masked when displayed and that a maximum of the first 6 and last 4 digits of the PAN can be displayed. Note …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
What is the involvement of the PCI SSC on the compliance validation processes for PCI DSS assessments and scan reports?
While the PCI Security Standards Council (PCI SSC) manages the security standards and provides training for security assessors, we do not enforce compliance or define validation reporting requirements. Compliance validation …
What is SAQ C-VT?
SAQ C-VT is a self-assessment questionnaire designed for brick-and-mortar (card-present) or mail/telephone-order (card-not-present) merchants that process cardholder data via virtual terminals on personal computers connected to the Internet, and that …
How does my company become a qualified assessor (QSA, PA-QSA, QSA (P2PE), PA-QSA (P2PE)), or Approved Scanning Vendor (ASV)?
The PCI Security Standards Council (PCI SSC) maintains a robust evaluation and qualification program for approved security assessors and scanning vendors. Information on becoming a qualified assessor or scan vendor …
Does SAQ C-VT replace SAQ C?
SAQ C-VT does not replace SAQ C. Each SAQ is designed to support a different type of cardholder data environment. At a high level, SAQ C is intended for merchants …
What is a VT or Virtual Terminal?
A virtual terminal is web browser-based access to an acquirer, processor or third party service provider website to authorize payment card transactions over the Internet, where the merchant manually enters …
How do I reduce the scope of a PCI DSS assessment?
Network segmentation of, or isolating (segmenting), the cardholder data environment from the remainder of an entity?s network is strongly recommended as a method that may reduce the scope of a …
For the list of Validated PA-DSS Applications, what is the difference between Revalidation Date and Expiry Date?
Revalidation Date: Annually, the software vendor is required to revalidate by completing Part 3b of the Attestation of Validation form, confirming that no changes have been made to the application …
Can a payment application that implements the same cryptographic keys across multiple installations be PA-DSS compliant?
No. If cryptographic keys are provided by the application vendor as part of the application, the keys must be unique to each customer or installation. An application that requires the …
Can a payment application that uses cryptographic keys hard-coded by the vendor be PA-DSS compliant if they cannot be changed by the customer?
No. In order to meet PA-DSS and PCI DSS requirements, the payment application must facilitate the customers? ability to perform key changes periodically and as required by the customer in …