PCI FAQs Index

All published PCI FAQs,
indexed in one place.

s

The best ways to keep up to date are to use the PCI FAQ page “Newly Added” and “Most Recently Updated” queries or to follow the FAQ RSS feed.

Note: This page is maintained manually and was last updated on 2021-11-30
it indexes 309 FAQs with the last being #1554.

s
ArticleLink
#1554What is a PCI SSC Participating Payment Brand?
#1548Are Secure Software Assessors or Secure Software Lifecycle Assessors required to report Continuing Professional Education (CPE) credits to PCI SSC?
#1547Are currently listed PA-DSS payment applications required to be revalidated using the Secure Software Standard?
#1546Can multiple changes for a Secure Software listing be submitted within a single change submission?
#1545Are there prerequisite PCI SSC program requirements to meet before qualifying as an SSF Assessor Company?
#1544Does PCI SSC provide a list of software vendors whose software development process(es) have been validated to the Secure SLC Standard?
#1543Who is qualified to perform assessments to the PCI Secure SLC Standard?
#1542What is the process for PCI Secure SLC Qualification?
#1541When must validated payment software be revalidated?
#1540What software is eligible for validation to the PCI Secure Software Standard?
#1539Who is qualified to perform assessments to the PCI Secure Software Standard?
#1538What is the process to initiate a software evaluation to the PCI Secure Software Standard?
#1537Are remote assessments permitted for PCI DSS?
#1536What is a compliance-accepting entity?
#1533For PCI DSS, why is storage of sensitive authentication data (SAD) after authorization not permitted even when there are no primary account numbers (PANs) in an environment?
#1496Are entities expected to do onsite audits of personnel work-from-home environments?
#1495Is an assessor required to visit work-from-home environments to determine if personnel are meeting PCI DSS requirements?
#1494For personnel working from home, is the work-from-home environment considered a “sensitive area” for PCI DSS Requirement 9?
#1493What is the PCI 3DS (3D Secure) Core Security Standard?
#1492How can an entity meet PCI DSS requirements for PAN masking and truncation if it has migrated to 8-digit BINs?
#1491Does PCI DSS define which versions of TLS must be used?
#1490Can a PCI 3DS Assessment result in a finding of “Compliant” if some requirements are not tested?
#1489Is an EMVCo Letter of Approval required prior to conducting a PCI 3DS Assessment?
#1488What types of 3DS components are in scope for Requirement P2-7 in the PCI 3DS Core Security Standard?
#1487Can a 3DS entity outsource the hosting and management of its HSMs to a third-party service provider?
#1486Can the “Compliant but with Legal exception” option in the AOC be used to identify where a testing procedure could not be performed due to a legal constraint?
#1485What is the meaning of “initial assessment” in PCI DSS?
#1484If a P2PE Solution is shown as red or orange on PCI’s list of Validated P2PE Solutions, does the solution meet the eligibility criteria for SAQ P2PE?
#1483If a P2PE Solution is on PCI’s list of Point-to-Point Encryption Solutions with Expired Validations, does the solution meet the eligibility criteria for SAQ P2PE?
#1482Are P2PE Products (P2PE Solutions, P2PE Components, P2PE Applications) on the P2PE Expired Listings still considered “validated” per the P2PE Program Guide?
#1481What type of assessor signatures are allowable for PCI SSC attestation documentation?
#1480Which P2PE Program Guide version do I use?
#1479Can PCI-listed P2PE v2 components be used as part of a P2PE v3 solution?
#1478Can PCI-listed P2PE v3 components be used as part of a P2PE v2 solution?
#1477Are software vendors wishing to undergo validation to the PCI Secure Software Lifecycle (Secure SLC) Standard also required to have payment software listed or in the process of being validated to the PCI Secure Software Standard?
#1473What is the role of acquirers and assessors in determining the applicability of PCI DSS requirements for a merchant’s PCI DSS assessment?
#1472How can I determine whether a QSA is authorized to perform PCI DSS assessments in all countries that are in scope for my company's PCI DSS assessment?
#1471What does 'Servicing Market' on the QSA listing mean?
#1470Are PFIs required to fill out all the fields in the Final PFI Report?
#1469How do PCI PTS-approved HSM expiry dates affect a PCI-listed P2PE Solution or Component?
#1468Can I have the same assessor company or individual assessor perform a PCI DSS and PIN Assessment for our organization?
#1467Can organizations use alternative password management methods to meet PCI DSS Requirement 8?
#1464Does the use of expired PTS POI devices meet eligibility criteria for SAQ B-IP?
#1462What does 'Window of Payment Card Data Storage' mean in the Final PFI Report template?
#1461What-are-the-security-considerations-for-TLS-1-3?
#1460Where should reports be sent when the PFI investigation has concluded there is no evidence of a breach?
#1458What date should be used for 'Date of Report' in the ROC?
#1457Are either Software-based PIN Entry on COTS Solutions or Contactless Payments on COTS Solutions eligible for a P2PE Solution approval?
#1456Can PCI SSC revoke a QSA Company's eligibility to participate in the Associate QSA Program due to quality concerns in connection with that program, and not revoke qualification as a QSA Company?
#1455Does a QSA need to be onsite at the client's premises for all aspects of a PCI DSS assessment?
#1454What is the intent of 'administrative access' in PCI DSS?
#1453Can a PFI Company provide QSA services to an entity after performing a PFI investigation for that entity?
#1452How does Triple DEA (TDEA) impact ASV Scan results?
#1451Can PFIs provide reports to their clients before sending the report to the affected payment brands?
#1450Where can I find more information about the Assessment Guidance for Non-listed Encryption Solutions (aka NESA)?
#1449Is two-step authentication acceptable for PCI DSS Requirement 8.3?
#1448What is meant by 'at risk' and 'at-risk timeframe' referenced in the Final PFI Report?
#1447How does PCI DSS Requirement 11.3.4.1 impact timing of penetration tests for service providers?
#1446How did Prioritized Approach Tool calculations change for PCI DSS v3.2?
#1445How should QSA assistance with completion of Self-Assessment Questionnaire (SAQs) be documented?
#1444Can a PFI Company perform subsequent PFI investigations for the same entity?
#1443What is the intent of the SAQ eligibility criteria?
#1442Can merchants using non-console administrative access be eligible for SAQ B-IP, C-VT, or C?
#1441How do the updated SSL/early TLS migration dates apply to service providers?
#1440How does PCI DSS Appendix A2 apply after the SSL/early TLS migration deadline?
#1439How do PCI DSS Requirements 2, 6 and 8 apply to SAQ A merchants?
#1438How is the payment page determined for SAQ A merchants using iframe?
#1437Can PCI DSS be used to protect non-payment card data?
#1436Who has to comply with the PCI standards?
#1435What is the Council's guidance on the use of SHA-1?
#1434How do PCI PTS-approved POI device expiry dates affect a PCI-listed P2PE solution?
#1427Are OEMs and/or hardware/software resellers subject to PCI DSS Requirements 12.8 and 12.9?
#1426Is 'two-step' authentication the same as 'two-factor' or 'multi-factor' authentication?
#1425What is the difference between 'multi-factor' authentication and 'two-factor' authentication?
#1385Which types of tokens are addressed by the PCI SSC tokenization documents?
#1384What is the difference between 'acquiring tokens', 'issuer tokens', and 'Payment Tokens'?
#1383To whom do the PCI Token Service Provider Security Requirements apply?
#1382Can a partial PCI DSS assessment be documented in a Report on Compliance (ROC)?
#1375Can an Attestation of Compliance (AOC) be provided to an assessed entity before the Report on Compliance (ROC) is finalized?
#1374Is Payment Account Reference (PAR) as defined by EMVCo considered PCI Account Data?
#1373How should entities complete their ROC or SAQ for PCI DSS v3.1 using the new SSL/TLS migration dates?
#1372How should entities apply the new SSL/TLS migration dates to Requirements 2.2.3, 2.3 and 4.1 for PCI DSS v3.1?
#1369Does PCI P2PE allow for partial assessments of third parties with services that will be used in one or more P2PE solutions?
#1368Can PCI-listed P2PE v3 applications be used in PCI P2PE v2 listed solutions/components?
#1367Can PCI-listed P2PE v2.0 applications be used in PCI P2PE v3 solutions/components?
#1358Which version of the P2PE Standard should be used for a P2PE assessment?
#1356What does 'Duly Authorized Officer' mean?
#1355Are applications listed as Acceptable only for Pre-existing Deployments able to meet the current PA-DSS and PCI DSS?
#1354Can the AOC be redacted to protect sensitive information?
#1339Are POI devices with only PTS-approved firmware (i.e., no additional software) eligible for use in a PCI P2PE solution?
#1338What is the difference between POI firmware and additional software that may be present on the POI device?
#1335Does PCI DSS apply to bank account data?
#1334Where can I find unlocked versions of the AOCs and SAQs?
#1333Can PCI DSS compliance be determined by testing only pre-production environments using test data?
#1332Is a merchant website still in scope for PCI DSS if it meets all the criteria for SAQ A?
#1331Can SAQ eligibility criteria be used for determining applicability of PCI DSS requirements for onsite assessments?
#1330For P2PE solutions, can you use PCI approved POI devices with SRED, where the PTS listing indicates 'Non CTLS'?
#1329What is the current version of PA-DSS?
#1328What version of PCI DSS should I use?
#1327Do PANs need to be masked on cardholder statements sent by issuers to customers?
#1326How does PCI DSS apply to EMVCo Payment Tokens?
#1325Does PCI SSC provide a 'PCI DSS Compliant' logo?
#1324What changes are PFI companies allowed to make to the PFI Reporting Templates?
#1323Are disaster-recovery (DR) sites in scope for PCI DSS?
#1322What are the expiry dates for PTS POI device approvals?
#1321Do parent/subsidiary companies validate as a single entity or as separate entities?
#1320Who do I report insecure merchant behavior to?
#1319Are merchants allowed to request card-verification codes/values from cardholders?
#1318What is the maximum period of time that cardholder data can be stored?
#1317What is a 'significant change' for PCI DSS Requirements 11.2 and 11.3?
#1316Are merchants required to perform the 'Expected Testing' in the SAQs?
#1315Is storage of truncated PAN considered storage of 'cardholder data' per the SAQ eligibility criteria?
#1314Is storage of encrypted cardholder data considered 'cardholder data' per the SAQ eligibility criteria?
#1313Can SAQ B-IP be used if cardholder data is transmitted over wireless?
#1312If an entity uses a service provider that is not PCI DSS compliant, how does this impact the entity's compliance?
#1311Are PFI Companies which are 'in remediation' permitted to perform investigations?
#1310Are merchants allowed to request that cardholder data be provided over end-user messaging technologies?
#1309Must payment applications ensure that hashed and truncated versions cannot be correlated?
#1308How can an entity ensure that hashed and truncated versions cannot be correlated, as required in PCI DSS Requirement 3.4?
#1306Are PCI Forensic Investigators (PFIs) permitted to enter into retainer-type agreements with merchants and service providers?
#1305Do you offer examination accommodation?
#1304What devices does PCI DSS Requirement 10.6.2 apply to?
#1302How does use of an expired PTS device affect my PCI DSS compliance?
#1301How do PTS-approved payment terminals support PCI DSS compliance?
#1300How does PCI DSS apply to payment terminals?
#1299Are manual imprinter machines in scope for PCI DSS requirements?
#1293If a merchant's e-commerce implementation meets the criteria that all elements of payment pages originate from a PCI DSS compliant service provider, is the merchant eligible to complete SAQ A or SAQ A-EP?
#1292Why is there a different approach for Direct Post implementations than for iFrame and URL redirect - what are the technical differences and how do they impact the security of e-commerce transactions?
#1291Why is SAQ A-EP used for Direct Post while SAQ A is used for iFrame or URL redirect?
#1290If a merchant uses a service provider to host part or all of their CDE, and the service provider has been validated as PCI DSS compliant, is the merchant's assessor required to go onsite to the third party location and retest the PCI DSS requirements?
#1289Does the PA-DSS v3 requirement for hashing stored passwords meet PCI DSS Requirement 8.2.1?
#1288Does PA-DSS Requirement 3.3.2 apply to passwords used by the payment application to access other systems/applications (e.g. for the payment application to access a third-party database)?
#1287Why does PA-DSS v3 require passwords to be protected by a one-way hash (Requirement 3.3.2), whereas PANs can be stored in an encrypted form (Requirement 2.3)?
#1286Does PCI DSS apply to virtual (electronic-only) PANs?
#1285Does PCI DSS apply to one-time or single-use PANs?
#1284Are acquirers considered service providers for the purpose of PCI DSS Requirements 12.8 and 12.9?
#1283If a merchant develops an application that runs on a consumer's device (e.g. smartphone, tablet, or laptop) that is used to accept payment card data, what are the merchant's obligations regarding PCI DSS and PA-DSS for that application?
#1282Can an entity be PCI DSS compliant if they use a service provider that is validated to a previous version of PCI DSS?
#1281Are point-of-sale devices required to be physically secured (e.g. with a cable or tether) to prevent removal or substitution in order to meet PCI DSS Requirement 9.9?
#1280Can card verification codes/values be stored for card-on-file or recurring transactions?
#1279How does using a PA-DSS validated application affect the scope of a merchant's PCI DSS assessment?
#1278Are PA-DSS applications considered valid if installed on an operating system that is not included in the payment application listing?
#1277Are merchants required to meet PCI DSS Requirement 12.9?
#1275What are the PA-DSS Expiry Dates?
#1274Can my payment application be validated using PA-DSS Version 2?
#1273Can my payment application be validated using PA-DSS Version 3.0 or 3.1?
#1272Can my payment application be validated using PA-DSS Version 1.2.1?
#1271Can I combine sections from different versions of the PA-DSS?
#1270How do the requirements in PCI DSS version 3 that are 'best practices' until June 30th 2015 impact my PCI DSS assessment?
#1266I'm in the middle of a PCI DSS assessment when a new version is released - should I start again using the new version?
#1265Can I combine sections from different versions of the PCI DSS?`
#1263What are the Card Production Logical and Physical Security Requirements?
#1262Will PA-DSS validated applications continue to be Acceptable for New Deployments if they run on an unsupported operating system?
#1261Does a P2PE validated application also need to be validated against PA-DSS?
#1258Does PCI SSC endorse specific products to meet PCI DSS requirements?
#1257Can I report on my Prioritized Approach progress instead of producing a Report on Compliance or Attestation of Compliance?
#1254What is the intent of PCI DSS requirement 10?
#1253Does hashing of passwords meet the intent of PCI DSS Requirement 8.2.1?
#1252Do all PCI DSS requirements apply to every system component?
#1251What is the process to use previously-deployed POI devices in a PCI P2PE Solution?
#1248In P2PE, how do 'hybrid'decryption environments differ from 'hardware' decryption environments?
#1247Who can use SAQ P2PE?
#1246Can a QSA that is not also a P2PE Assessor validate an encryption solution meets P2PE Requirements?
#1235If a merchant or service provider has internal corporate credit cards used by employees for company purchases like travel or office supplies, are these corporate cards considered 'in scope' for PCI DSS?
#1234I have had an external vulnerability scan completed by an ASV, does this mean I am PCI DSS compliant?
#1233How does encrypted cardholder data impact PCI DSS scope for third-party service providers?
#1229What is SAQ C-VT?
#1228Will the PCI Security Standards Council approve and list vendors for participation in forensics investigations?
#1227Who are the founders of the PCI Security Standards Council?
#1226What is the role of the Advisory Board?
#1225What is the relationship between the PCI Data Security Standard and the Payment Application Data Security Standard and PTS Device Security Requirements?
#1224What does one function per server mean?
#1223Does PCI DSS, PA-DSS, or PTS apply to ATMs?
#1222Does cardholder name, expiration date, etc. need to be rendered unreadable if stored in conjunction with the PAN (Primary Account Number)?
#1221Do shared hosting providers need to comply with PCI DSS?
#1220Are compliance certificates recognized for PCI DSS validation?
#1217Does the PCI DSS apply to issuers?
#1216Does the PCI DSS apply to acquirers?
#1215What is the PCI DSS Self-Assessment Questionnaire?
#1214Do the PCI DSS requirements apply to card manufacturers, embossers, card personalizers, or entities that prepare data for card manufacturing?
#1213Are there any plans to standardize the reporting requirements (reports) for the PCI DSS, PA-DSS, ASV, QSA and PTS programs that are sent to each of the payment brands?
#1212What is the involvement of the PCI SSC on the compliance validation processes for PCI DSS assessments and scan reports?
#1211To whom should media inquiries or requests for interviews about the PCI Security Standard Council be directed?
#1210Are audio/voice recordings permitted to contain sensitive authentication data?
#1196If I am deemed PCI DSS compliant today by one of the payment card brands, will the other brands in the PCI Security Standards Council recognize this designation of compliance and if so, what information must be put forth to achieve such recognition?
#1195What is the difference between a Validated Payment Application which is shown on the PCI SSC website as “Acceptable for New Deployments” and one which is shown as “Acceptable only for Pre-Existing Deployments”?
#1183The PA-DSS Program Guide says application version numbers may consist of a combination of fixed and variable alphanumeric characters. What does this mean?
#1182Is it acceptable to make minor changes to a PA-DSS validated application and retain the existing version number?
#1181How can I check whether a payment application is PA-DSS validated?
#1178How do I reduce the scope of a PCI DSS assessment?
#1177How does my company become a qualified assessor (QSA, PA-QSA, QSA (P2PE), PA-QSA (P2PE)), or Approved Scanning Vendor (ASV)?
#1176How does an organization maintain compliance when a standard changes?
#1175If a merchant is using a payment application listed as 'acceptable only for pre-existing deployments', is the merchant allowed to install more copies of the application?
#1174For the list of Validated PA-DSS Applications, what is the difference between Revalidation Date and Expiry Date?
#1173Who is qualified to perform PA-DSS assessments?
#1172Does the Prioritized Approach replace the PCI DSS?
#1171Is the Prioritized Approach mandatory?
#1170How does the Prioritized Approach work?
#1169What are the Council's requirements for QSA and ASV Companies to maintain a Quality Assurance (QA) manual?
#1168What assurances does the Council provide regarding the quality of organizations assessing my systems for compliance with the PCI standards?
#1166Which PCI PTS point-of-interaction (POI) devices can be used in a validated P2PE solution?
#1165Are P2PE solution providers required to have their solutions validated and listed by the Council?
#1164Is the PCI P2PE Standard applicable for merchants that have developed/implemented their own encryption solution?
#1163Is a 'P2PE Assessor' required for a merchant's PCI DSS assessment if the merchant uses a Council-listed P2PE solution?
#1162Can merchants use encryption solutions not listed on the PCI Council's website to reduce their PCI DSS validation effort?
#1158What effect does the use of a PCI-listed P2PE solution have on a merchant's PCI DSS validation?
#1157What should a merchant do if cardholder data is accidentally received via an unintended channel?
#1156Are call center environments considered 'sensitive areas' for PCI DSS Requirement 9.1.1?
#1155Which service provider category should I use for Part 2 of the PCI DSS Attestation of Compliance (AOC) for Service Providers?
#1154Is pre-authorization account data in scope for PCI DSS?
#1153How does PCI DSS apply to VoIP?
#1152Can an entity be PCI DSS compliant if they have performed quarterly scans, but do not have four 'passing' scans?
#1147What is the purpose of requiring consoles/PCs to become 'locked' after 15 minutes of idle time, per PCI DSS Requirement 8.1.8?
#1146What is the difference between masking and truncation?
#1142How do I contact the payment card brands?
#1141What are the fines and penalties assessed to companies for non-compliance with the PCI DSS?
#1140Which Self-assessment Questionnaire (SAQ) should I complete?
#1139Can I fax payment card numbers and still be PCI DSS Compliant?
#1138Does PCI SSC provide a list of PCI DSS-compliant service providers?
#1137How can I validate if a number is a legitimate credit card number?
#1136Can the full payment card number be printed on the consumer's copy of the receipt?
#1135Can VLANS be used for network segmentation?
#1134What are the steps needed to perform a self assessment to validate compliance with PCI DSS?
#1133Why are there multiple PCI DSS Self-assessment Questionnaires (SAQs)?
#1132What is an Attestation of Compliance?
#1131Does the council have a mapping between PCI DSS and ISO 27002 (formerly ISO 17799) or other standards?
#1130Are operating systems that are no longer supported by the vendor non-compliant with the PCI DSS?
#1129Does media containing cardholder data (for example, backup tapes or disks) need to be physically labeled as confidential for PCI DSS Requirement 9.6.1?
#1128What happens if I'm using a PA-DSS validated payment application that is breached?
#1127Is there opportunity to provide feedback on the PCI Council's standards?
#1126How do I determine whether my business would be required to conduct an independent assessment or a self-assessment?
#1125Are there any plans for PCI SSC to be a single point of contact for a merchant, financial institute or processor to send a PCI DSS compliance report to?
#1124PCI DSS provides a common data security standard across all payment brands. Are there any plans to provide a common structure of penalties and/or fines for non-compliance to this standard?
#1123In what way does the PCI Security Standards Council make payment card data more secure?
#1122What is the scope of the PCI Security Standards Council's activities?
#1117Are truncated Primary Account Numbers (PAN) required to be protected in accordance with PCI DSS?
#1115How does PCI DSS apply to individual PCs or workstations?
#1096When a QSA or ASV is newly approved, who is the contact at the PCI Security Standards Council to request a press release?
#1095What will be the role of the PCI Security Standards Council in expanding the global coverage of both QSAs and ASVs?
#1094Will the PCI Security Standards Council be involved in performing forensics investigations as a result of an account data compromise event?
#1093Does Requirement 3.4 apply to mainframes?
#1092Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?
#1091What are acceptable formats for truncation of primary account numbers
#1089Are hashed Primary Account Numbers (PAN) considered cardholder data that must be protected in accordance with PCI DSS?
#1088What is meant by 'adequate network segmentation' in the PCI DSS?
#1087For vulnerability scans, what is meant by quarterly?
#1086How does encrypted cardholder data impact PCI DSS scope?
#1085Can unencrypted PANs be sent over e-mail, instant messaging, SMS, or chat?
#1084What is the intent of PCI DSS Requirement 3.4.1?
#1083What is the mission of the PCI Security Standards Council?
#1082If a merchant has multiple processing environments, should the merchant complete multiple SAQ to validate their PCI DSS compliance?
#1081Does PCI DSS Requirements 10.2 and 10.3 mean that both database and application logging is required?
#1080Are administrators allowed to share passwords?
#1079What is the definition of 'merchant'?
#1078In what circumstances is multi-factor authentication required?
#1077How extensive must background checks be for employees who have access to cardholder data?
#1076Is it permissible to use FTP if proper security measures are implemented?
#1075Is it permissible to use self-decrypting files for encryption to send cardholder data?
#1074Is intrusion detection required if centralized log correlation is in place?
#1073What are the PCI DSS requirements regarding transmission of cardholder data via Bluetooth technology?
#1072What is the purpose of requiring account lockout, per PCI DSS Requirements 8.1.6 and 8.1.7?
#1071Can the full credit card number be displayed within a browser window?
#1070Are digital images containing cardholder data and/or sensitive authentication data included in the scope of the PCI DSS?
#1069Does PCI DSS apply to paper with cardholder data (for example, receipts, reports, etc.)?
#1068Are digital leased lines considered public or private?
#1067What is meant by 'non-consumer users' in PCI DSS Requirement 8?
#1066What is an 'inactive user account' as used in PCI DSS Requirement 8.1.4?
#1065Should service providers demonstrate PCI DSS compliance as part of their client's assessment or in their own separate assessment?
#1064What is a VT or Virtual Terminal?
#1063Does SAQ C-VT replace SAQ C?
#1062What is meant by a 'payment application' in Part 2d of the Attestation of Compliance?
#1061How frequently will the PCI Security Standards Council update the PCI DSS and PA-DSS?
#1060How would an identified Denial of Service (DoS) vulnerability affect a company's ability to pass a PCI DSS vulnerability scan from an Approved Scanning Vendor (ASV)?
#1055Should I complete the Prioritized Approach milestones in sequential order?
#1054Does the PCI Security Standards Council provide information on security breaches, status of investigations, or PCI DSS compliance status?
#1053Can a payment application that uses cryptographic keys hard-coded by the vendor be PA-DSS compliant if they cannot be changed by the customer?
#1052Can a payment application that implements the same cryptographic keys across multiple installations be PA-DSS compliant?
#1051Can application whitelisting be used to meet PCI DSS Requirement 5?
#1050I make ATMs, what do I need to do for PTS?
#1046Will the PCI Security Standards Council 'approve' my organization's implementation of compensating controls in my effort to comply with the PCI DSS?
#1045Is MPLS considered a private or public network when transmitting cardholder data?
#1044Do ISPs that provide only internet connection need to comply with the PCI DSS?
#1043Is frame relay considered a private network and are there any encryption requirements?
#1042Should cardholder data be encrypted while in memory?
#1041What is the scope of a PCI DSS assessment for a network that is not segmented?
#1040Is it required that all of a company's sites, even those located in other countries, must be included in the company's PCI DSS review?
#1039Does PCI DSS apply to debit cards, debit payments, and debit systems?
#1038Does PCI DSS apply to 'hot cards', expired, cancelled or invalid card account numbers?
#1037Do hosting providers have responsibility for liabilities/fines?
#1036How can I provide feedback (negative or positive) about my QSA/ASV?
#1035What is the definition of 'remote access'?
#1034What are system-level objects, as identified in PCI DSS Requirement 10.2.7?
#1033Can you provide clarification for logging/audit trail per PCI DSS requirements 10.2.5 and 10.2.6?
#1032Can you provide clarification of PCI DSS requirement 10.3.6?
#1024Is PCI DSS a global standard?
#1023What are the requirements that have to be satisfied to be in compliance with the PCI Data Security Standard?
#1022Do small merchants with limited transaction volumes need comply with PCI DSS?
#1021How much will it cost for a vendor to have their products validated to PA-DSS by a PA-QSA?
#1020How does PA-DSS support a merchant's PCI DSS compliance?
#1019If my business was deemed compliant but my system was still breached and payment account data compromised after the fact, what liability would my business incur?
#1018Will the PCI Security Standards Council list compliant service providers and/or merchants on its Web site?
#1017How can my organization find assistance in completing the Self-Assessment Questionnaire?
#1016I want to add input into this process. How do I become a member of the Council?
#1015What are the consequences to my business if I do not comply with the PCI DSS?
#1014Do QSAs and ASVs need to send reports of compliance (ROCs) or scanning results to the PCI Security Standards Council directly?
#1011Once my business has been determined to be compliant by a QSA would I or the QSA need to communicate this fact to the PCI Security Standards Council?
#1009In case of a suspected breach, should the PCI Security Standards Council be contacted directly?
#1004Does the PCI Security Standards Council enforce compliance?
#1003Where is the PCI Security Standards Council Located?