Should cardholder data be encrypted while in memory?
If the cardholder data is stored in non-persistent memory (e.g. RAM), encryption of cardholder data is not required. However, proper controls must be in place to ensure that memory maintains …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
What is the scope of a PCI DSS assessment for a network that is not segmented?
Without proper network segmentation to isolate the systems that store, process or transmit cardholder data from those that do not, all system components in that network are considered part of …
Is it required that all of a company's sites, even those located in other countries, must be included in the company's PCI DSS review?
The PCI DSS is a global standard and is applicable to all entities that process, transmit or store cardholder data regardless of geographic location. Each payment brand manages their PCI …
Does PCI DSS apply to debit cards, debit payments, and debit systems?
Any payment card (credit, debit, prepaid, stored value, gift or chip) bearing the logo of one of the PCI Security Standards Council's five founding payment brands is required to be …
Does PCI DSS apply to "hot cards," fraudulent or invalid card numbers, or cancelled cards?
If the issuer confirms the cards are inactive or disabled, the PANs (Primary Account Numbers) no longer pose fraud risk to the payment system. The PCI DSS would not apply …
Do hosting providers have responsibility for liabilities/fines?
Questions about compliance and possible fines due to a compromise should be addressed directly to the payment card brands and/or acquirers.
How can I provide feedback (negative or positive) about my QSA/ASV?
Merchants or service providers are encouraged to submit feedback about their QSA/ASV through the feedback form available on our website at https://www.pcisecuritystandards.org/program-listings-overview/give_assessor_feedback/. QSAs and ASVs are contractually obligated to …
Is PCI DSS a global standard?
The PCI DSS is a global standard, with compliance expected of any entity that stores, processes or transmit cardholder data regardless of geographic location. Each payment brand manages their PCI …
How much will it cost for a vendor to have their products validated to PA-DSS by a PA-QSA?
Fees for validation services are set independently by the PA-QSAs.
How does the PCI PA-DSS integrate with the PCI Data Security Standard (DSS)?
The requirements for Payment Application Data Security Standard (PA-DSS) are derived from the Payment Card Industry Data Security Standard (PCI DSS). This document details what is required for a merchant …