How much will it cost for a vendor to have their products validated to PA-DSS by a PA-QSA?
Fees for validation services are set independently by the PA-QSAs.
Deleted FAQs
FAQs that have been removed from the PCI SSC website or have dead links.
Is ?two-step? authentication the same as ?two-factor? or ?multi-factor? authentication?
?Two-step? or ?multi-step? authentication is not the same as ?two-factor? or ?multi-factor?. ?Two-step? or ?multi-step? authentication involves the subsequent presentation of one or more authentication steps after the first authentication …
What will be the role of the PCI Security Standards Council in expanding the global coverage of both QSAs and ASVs?
The PCI Security Standards Council will make reasonable efforts to evaluate global coverage for both QSAs and ASVs, and will attempt to identify and encourage participation by qualified parties to …Shared Passwords
Test FAQ
Can my payment application be validated using PA-DSS Version 3.0 or 3.1?
New validations and High Impact Changes using PA-DSS v3.1 will be accepted until 31 August 2016. Low Impact and No Impact Changes to listed applications that were previously validated to …
When do I have to start using PCI DSS 3.0?
PCI DSS version 3.0 is effective from January 1st, 2014, and all entities should be working towards compliance with the latest PCI standards as soon as they are …
Can my payment application be validated using PA-DSS Version 1.2.1?
No. PA-DSS version 1.2.1 is expired. New application validations using PA-DSS 1.2.1 and changes for existing listings using PA-DSS 1.2.1 are no longer accepted. In addition, applications validated using PA-DSS …
Must payment applications ensure that hashed and truncated versions cannot be correlated?
Yes, a payment application designed to store both hashed and truncated PAN is required to have additional controls to prevent their correlation, as noted in PA-DSS Requirement 2.3. This is …
Does the PA-DSS v3.0 requirement for hashing stored passwords meet PCI DSS Requirement 8.2.1?
Yes; PA-DSS v3.0 requires that a strong, one-way cryptographic algorithm with a unique input variable be used to render all payment application passwords unreadable during storage. This meets the intent …
Why does PA-DSS v3.0 require passwords to be protected by a one-way hash (Requirement 3.3.2), whereas PANs can be stored in an encrypted form (Requirement 2.3)?
A payment application is required to restrict administrative access and access to cardholder data to authenticated (Requirement 3.1.4), authorized (Requirement 3.1) users. Where users authenticate to the payment application using …