The latest changes across all tracked PCI resources.
In a hardware decryption environment, all decryption operations are performed only by PCI listed or FIPS approved HSMs.In a hybrid decryption environment, the decryption of account data is performed on …
As of 12 December 2019, the latest version of the P2PE Standard is v3.0
P2PE v2.0 assessments will be accepted by the Council until 30 June 2021.
Currently …
A validated (as per the PCI P2PE Program Guide) P2PE solution/component must use a non-expired PCI-approved point-of-interaction (POI) device, which has been evaluated and approved via the PCI PTS program …
SAQ P2PE is intended for SAQ-eligible merchants or merchant environments (as determined by the individual payment card brands), who process cardholder data only via PCI-approved point of interaction (POI) devices …
(Note the term "solution provider" below can be used interchangeably with "component provider," depending on the entity managing the POI devices.) Please refer to the latest P2PE glossary for …
Yes. However, while it may be possible for a PCI POI device to implement all the necessary functionality for use in a P2PE solution solely within its existing PTS-approved firmware, …
The P2PE Standard does not require applications solely used in a P2PE solution to be validated to PA-DSS. PA-DSS and P2PE are distinct PCI standards with separate requirements and programs, …
PCI-listed P2PE solutions (and applicable P2PE components) are allowed toreassess their existing PCI P2PE approval with expired PTS POI devices for up to, but not exceeding, 5 years past the …
A high-level summary of expiry dates for each version of the PTS POI Security Requirements is provided below. Full details can be found in the PCI PTS Device Testing and …
No. The Software-based PIN Entry on COTS (SPoC)? Standard, Contactless Payments on COTS (CPoC?) Standard and P2PE Standard are separate PCI SSC standards intended for unique use cases.
While PCI DSS does not require that PCI PTS-approved devices be used, some payment brands have their own requirements for using PTS-approved devices, including whether PTS devices with expired approvals …
No, PCI SSC does not provide a list of PCI DSS-compliant service providers, nor does PCI SSC certify service providers as PCI DSS compliant.
PCI DSS is applicable to …
PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data (SAD), including card validation codes and values, after authorization even if the data is encrypted. Storage of card validation codes …
No, PCI DSS Requirement 9.9 does not require devices to be fixed in place or physically attached to a surface. Requirement 9.9 and its three sub-requirements address three areas of …
As described in PCI DSS Requirement 8.3, multi-factor authentication (previously referred to as two-factor authentication) is required for all remote network access that originates from outside the entity's own network, …