I am setting up a PCI compliance call center. I am wondering if my internet service provider has to be certified PCI compliant? I am only connecting to a cloud service that uses SSL and that cloud service is PCI compliant. Will I run into any issues if the ISP is not certified?


2 Answers 2


No, the ISP does not need to be PCI compliant in this regard. If you were not communicating over a secure channel (i.e. TLS) then you would be violating the data-in-transit requirements of PCI DSS anyway.

Another way to think about this is from the customer perspective - if there's a PCI DSS complaint public-facing website, does the customer's ISP have to be PCI DSS compliant? No - the onus is on you to ensure that the transport layer is properly encrypted.

In such cases, TLS is considered a compensating control, meaning that something that you are doing would not strictly be compliant (e.g. sending card data in transit through someone else's public network) but you have implemented additional security controls that mitigate that concern.

As an aside, keep in mind that the PCI council is in the process of deprecating TLS 1.0 (all prior versions are already deprecated) such that you will not be compliant if TLS 1.0, SSLv3, or SSLv2 are enabled on any service on your network.


No, the ISP is not included in the scope.

with that i highly recommand the review the PCI council supplementary for protecting telephone based payment card data, you can find it here : PCI DSS, Information Supplement-telephone based payment card data

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .