How much will it cost for a vendor to have their products validated to PA-DSS by a PA-QSA?
Fees for validation services are set independently by the PA-QSAs.
Deleted FAQs
FAQs that have been removed from the PCI SSC website or have dead links.
What is meant by "non-consumer users" in PCI DSS Requirement 8?
PCI DSS Requirement 8 addresses secure authentication requirements and requires that all passwords and other authentication credentials be securely managed. These requirements apply to all non-consumer users and administrators. The …
Who is qualified to perform PA-DSS assessments?
Payment Application Qualified Security Assessors (PA-QSAs) are qualified by the Council to validate payment applications for compliance to PA-DSS. A list of PA-QSAs is available on the Council website. A …
What will be the role of the PCI Security Standards Council in expanding the global coverage of both QSAs and ASVs?
The PCI Security Standards Council will make reasonable efforts to evaluate global coverage for both QSAs and ASVs, and will attempt to identify and encourage participation by qualified parties to …
When does PCI DSS version 2.0 expire?
PCI DSS version 2.0 expires on December 31st, 2014, and any PCI DSS 2.0 validations must be completed prior to this date. PCI DSS version 3.0 is effective from January …
Can my payment application be validated using PA-DSS Version 2?
New application validations and High Impact Changes using PA-DSS 2.0 are no longer accepted. Low Impact and No Impact Changes to listed applications that were previously validated using PA-DSS 2.0 …
Must payment applications ensure that hashed and truncated versions cannot be correlated?
Yes, a payment application designed to store both hashed and truncated PAN is required to have additional controls to prevent their correlation, as noted in PA-DSS Requirement 2.3. This is …
Does the PA-DSS v3.0 requirement for hashing stored passwords meet PCI DSS Requirement 8.2.1?
Yes; PA-DSS v3.0 requires that a strong, one-way cryptographic algorithm with a unique input variable be used to render all payment application passwords unreadable during storage. This meets the intent …
Why does PA-DSS v3.0 require passwords to be protected by a one-way hash (Requirement 3.3.2), whereas PANs can be stored in an encrypted form (Requirement 2.3)?
A payment application is required to restrict administrative access and access to cardholder data to authenticated (Requirement 3.1.4), authorized (Requirement 3.1) users. Where users authenticate to the payment application using …
How can issuers be PCI DSS compliant if they store sensitive authentication data?
With regard to issuers or companies that support issuing services such as third party processors (TPPs), and other issuing type processors, it is recognized that such entities may have a …