Does PCI DSS require both database and application logging?
The intent of the PCI DSS logging requirements is to provide a complete record of who did what, where, when, and how, so it can be used for investigation in …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
Is intrusion detection required if centralized log correlation is in place?
Although log correlation is a valuable tool in a company's information security strategy, it does not replace intrusion detection mechanisms, such as IDS/IPS. Intrusion detection mechanisms provide proactive detection of …
Is MPLS considered a private or public network when transmitting cardholder data?
Whether an MPLS network can be considered a private network is dependent upon the specific provider and configuration of that network. The implementation would need to be evaluated to determine …
Should cardholder data be encrypted while in memory?
If the cardholder data is stored in non-persistent memory (e.g. RAM), encryption of cardholder data is not required. However, proper controls must be in place to ensure that memory maintains …
Does PCI DSS apply to "hot cards," expired, cancelled or invalid payment account numbers?
PCI DSS applies to any primary account number (PAN), including active, expired, or cancelled PAN, except where the organization can provide documentation which confirms that the PAN is inactive or …
How can my organization find assistance in completing the Self-Assessment Questionnaire?
The Council encourages organizations to seek professional guidance in achieving compliance and completing the Self-Assessment Questionnaire. Entities can use any security professional they choose; however, PCI SSC recommends engaging a …
What are system-level objects?
A system-level object is anything on a computer system required for its operation, including but not limited to application executables and configuration files, system configuration files, static and shared libraries …
Where do I direct questions about complying with PCI standards?
Each of PCI SSC's Participating Payment Brand members (American Express, Discover, JCB International, Mastercard, UnionPay, and Visa) currently have their own PCI compliance programs for the protection of their affiliated …
Is a QSA Employee that designs, develops, or implements specific controls for a customer also permitted to assess those same controls?
No. As per section 2.2 of the QSA Qualification Requirements, "The QSA Company must have separation of duties controls in place to ensure Assessor-Employees conducting or assisting with PCI …
Is a QSA Employee that designs, develops, or implements specific controls for a customer also permitted to assess those same controls?
No. As per section 2.2 of the QSA Qualification Requirements, ?The QSA Company must have separation of duties controls in place to ensure Assessor-Employees conducting or assisting with PCI …