What is the difference between masking and truncation?
Masking is addressed in PCI DSS Requirement 3.3, whereas truncation is one of several options specified to meet PCI DSS Requirement 3.4. Masking and truncation are both methods of rendering …
Recent FAQ Changes
Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?
PCI DSS applies to any entity that stores, processes or transmits cardholder data.
If a merchant outsources all their payment operations, the applicable PCI DSS requirements for the protection …
What are acceptable formats for masking of primary account numbers (PAN)?
PCI DSS Requirement 3.3 specifies that PAN is masked when displayed and that a maximum of the first 6 and last 4 digits of the PAN can be displayed. Note …
What is the involvement of the PCI SSC on the compliance validation processes for PCI DSS assessments and scan reports?
While the PCI Security Standards Council (PCI SSC) manages the security standards and provides training for security assessors, we do not enforce compliance or define validation reporting requirements. Compliance validation …
What is SAQ C-VT?
SAQ C-VT is a self-assessment questionnaire designed for brick-and-mortar (card-present) or mail/telephone-order (card-not-present) merchants that process cardholder data via virtual terminals on personal computers connected to the Internet, and that …
How does my company become a qualified assessor (QSA, PA-QSA, QSA (P2PE), PA-QSA (P2PE)), or Approved Scanning Vendor (ASV)?
The PCI Security Standards Council (PCI SSC) maintains a robust evaluation and qualification program for approved security assessors and scanning vendors. Information on becoming a qualified assessor or scan vendor …
Does SAQ C-VT replace SAQ C?
SAQ C-VT does not replace SAQ C. Each SAQ is designed to support a different type of cardholder data environment. At a high level, SAQ C is intended for merchants …
What is a VT or Virtual Terminal?
A virtual terminal is web browser-based access to an acquirer, processor or third party service provider website to authorize payment card transactions over the Internet, where the merchant manually enters …
How do I reduce the scope of a PCI DSS assessment?
Network segmentation of, or isolating (segmenting), the cardholder data environment from the remainder of an entity?s network is strongly recommended as a method that may reduce the scope of a …
For the list of Validated PA-DSS Applications, what is the difference between Revalidation Date and Expiry Date?
Revalidation Date: Annually, the software vendor is required to revalidate by completing Part 3b of the Attestation of Validation form, confirming that no changes have been made to the application …