How does the Prioritized Approach work?
The Prioritized Approach tool is intended to help guide non-compliant entities to work through the process of becoming PCI DSS compliant. The Prioritized Approach does not supersede or replace the …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
Should I complete the Prioritized Approach milestones in sequential order?
The Prioritized Approach was developed to address the highest common risks first in Milestone 1, the next highest risks in Milestone 2, etc. The Prioritized Approach provides a means to …
Does the Prioritized Approach replace the PCI DSS?
The Prioritized Approach is not a replacement for PCI DSS; rather, it reorganizes the PCI DSS requirements into security milestones, and is designed to help organizations working towards PCI DSS …
How frequently will the PCI Security Standards Council update the PCI DSS and PA-DSS?
To minimize changes to the standards, the PCI Security Standards Council (PCI SSC) has established a lifecycle approach for PCI DSS and PA-DSS, where version changes to the standards will …
How can I validate if a number is a legitimate credit card number?
The Luhn formula or Modulus 10 is the algorithm most often used to validate Primary Account Numbers (PAN). The algorithm works as follows: 1. double the value of alternate digits …
Do shared hosting providers need to comply with PCI DSS?
PCI DSS requirement 2.4 and appendix A: "PCI DSS applicability for hosting providers" is applicable to all shared hosting providers whose customers store, process, or transmit cardholder data. A shared …
Does cardholder name, expiration date, etc. need to be rendered unreadable if stored in conjunction with the PAN (Primary Account Number)?
For PCI DSS requirement 3.4 and protection of specific cardholder data elements, please refer to the table included in the PCI DSS on page 2 (www.pcisecuritystandards.org). The table …
Can you provide clarification of PCI DSS requirement 10.3.6?
The intent of PCI DSS requirement 10.3.6 is to provide the ability for an organization to identify the data, systems, or components affected when an unauthorized access attempt is being, …
Can you provide clarification for logging/audit trail per PCI DSS requirements 10.2.5 and 10.2.6?
PCI DSS requirement 10.2.5 requires organizations to log the use of identification and authentication mechanisms, which are typically used by administrators. These mechanisms include (but are not limited to activities …
Can the full payment card number be printed on the consumer's copy of the receipt?
PCI DSS requirement 3.3 states “Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed).” See also the note under …