Recent FAQ Changes RSS

Yes. The Expected Testing column of each SAQ provides a high-level description of the types of testing activities that should be performed in order to determine whether a requirement is …

An entity that receives and stores only truncated PAN does not need to consider this storage of cardholder data for the purposes of the SAQ eligibility criteria.

Merchants must …

Yes, encrypted cardholder data is considered cardholder data for the purposes of the SAQ eligibility criteria.

Merchants must meet all the defined eligibility criteria for a particular SAQ in …

Each payment brand determines their own compliance validation requirements, which may include specific requirements for companies comprised of multiple or separate entities. Organizations should contact their acquirer (merchant bank) and/or …

It is recommended that you discuss any concerns you have with the merchant in question. In many cases, once merchants have become aware of issues identified to them by their …

PCI DSS does not define minimum or maximum times for which cardholder data may be stored. PCI DSS Requirement 3.1 specifies that a data retention and disposal policy must be …

Yes. These values are typically used for card-not-present (CNP) transactions, where the card is not physically present at the merchant location (for example, during e-commerce or mail order/telephone order transactions). …

PCI DSS Requirements 11.2 and 11.3 address internal and external vulnerability scans and penetration testing respectively, including that they need to be performed after a significant change to the environment. …