Are there prerequisite PCI SSC program requirements to meet before qualifying as an SSF Assessor Company?
No, companies are not required to participate in other PCI SSC programs before becoming an SSF Company.
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
Is software-as-a-service (SaaS) eligible for Secure Software Standard validation and listing?
Yes, if the software in question meets all stated eligibility criteria in effect at the time of submission, software-as-a-service may be validated to the Secure Software Standard and listed on …
Are remote assessments permitted for PCI DSS?
While onsite assessments continue to be the expected method for PCI SSC assessments, the use of remote assessment methods may provide a suitable alternative in legitimate scenarios where an onsite …
What is a compliance-accepting entity?
When assessment results are associated with compliance programs defined and managed by one or more payment brands, the compliance-accepting entity is the entity to which those assessment results (for example, …
What is the difference between masking and truncation?
Masking is addressed in PCI DSS Requirement 3.3, whereas truncation is one of several options specified to meet PCI DSS Requirement 3.4.
Requirement 3.3 relates to protection of PAN …
Are truncated Primary Account Numbers (PAN) required to be protected in accordance with PCI DSS?
Systems that store, process, or transmit only truncated PANs (where a segment of PAN data has been permanently removed) may be considered out of scope for PCI DSS if those …
How does an organization maintain compliance when a standard changes?
PCI SSC updates its standards to address changes in payment industry threats, risks, and best practices. To ensure organizations have enough time to transition to a new standard, the previous …
What are acceptable formats for truncation of primary account numbers?
This update includes minor clarifications about acceptable PAN / BIN lengths, as follows:
- Adds UnionPay's PAN / BIN formats to the table.
- Reformats the table included in …
For PCI DSS, why is storage of sensitive authentication data (SAD) after authorization not permitted even when there are no primary account numbers (PANs) in an environment?
In the PCI DSS Applicability Information section of the standard, it is stated that sensitive authentication data must not be stored after authorization even if encrypted, and that this applies …
For personnel working from home, is the work-from-home environment considered a "sensitive area" for PCI DSS Requirement 9?
No. An individual's private work-from-home (WFH) environment is not considered a "sensitive area," and personnel working from home are not required to meet PCI DSS Requirements 9.1.1 or 9.3 for …