PCI-DSS compliance and certification appears to be used interchangeably however it isn't clear what the differences are.

For example if you are certified does it mean you are compliant and if you are compliant can you then apply for certification?


You are compliant if you follow all the rules of PCI-DSS that apply to your situation.

You are certified if an accredited independent auditor asserts, in his professional statute, that you are compliant to PCI-DSS.

If you apply for certification and the auditor finds out that you are not, in fact, compliant, then he will say so and point out the problems. It would still be up to you to fix the issues and try again.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.