What does "Servicing Markets" on the QSA listing mean?
The Servicing Markets element of the Qualified Security Assessor (QSA) listing indicates the geographic regions or countries for which the QSA Company is authorized by PCI SSC to perform PCI …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
Are PFIs required to fill out all the fields in the Final PFI Report?
Yes, per the Final PFI Report template instructions, the report template must be completed fully. Therefore, all fields are mandatory; any exceptions must be discussed with and approved by the …
How do PCI PTS-approved HSM expiry dates affect a PCI-listed P2PE Solution or Component?
P2PE Solutions and applicable P2PE Components undergoing an initial assessment (i.e., they are not performing a reassessment on an existing PCI P2PE approval listing) must use non-expired HSMs (i.e., not …
Can I have the same assessor company or individual assessor perform a PCI DSS and PIN Assessment for our organization?
An assessor that is listed as a QSA for PCI DSS and QPA for PCI PIN on the PCI SSC website may be eligible to perform both types of assessments, …
What date should be used for "Date of Report" in the ROC?
The "Date of Report" indicates the completion date of the ROC, and therefore must be no earlier than the date on which the QSA completed collection and validation of corresponding …
How do PCI DSS Requirements 2, 6 and 8 apply to SAQ A merchants
Merchants eligible to complete SAQ A are e-commerce or mail-order/telephone-order (MOTO) merchants that outsource all payment processing and do not store, process or transmit cardholder data on their premises or …
Can organizations use alternative password management methods to meet PCI DSS Requirement 8?
The password requirements in PCI DSS include a minimum level of complexity and strength intended to be met by all types of organizations using a range of technologies. PCI SSC …
How do PCI DSS Requirements 2, 6 and 8 apply to SAQ A merchants
Merchants eligible to complete SAQ A are e-commerce or mail-order/telephone-order (MOTO) merchants that outsource all payment processing and do not store, process or transmit cardholder data on their premises or …
Can organizations use alternative password management methods to meet PCI DSS Requirement 8?
The password requirements in PCI DSS include a minimum level of complexity and strength intended to be met by all types of organizations using a range of technologies. PCI SSC …
Is "two-step" authentication the same as "two-factor" or "multi-factor" authentication?
?Two-step" or "multi-step" authentication is not the same as "two-factor" or "multi-factor". "Two-step" or "multi-step" authentication involves the subsequent presentation of one or more authentication steps after the first authentication …