An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

0
votes
1answer
53 views

Scope of PCI DSS regarding CVV

According to PCI SSC, you can hold onto a CVV and other sensitive authentication data until authorization has occurred. In other words, the restriction on storing sensitive authentication data applies ...
0
votes
1answer
48 views

PCI CVV requirement - encrypt prior to authorisation?

Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorisation has occurred. In other words the restriction on storing sensitive authentication ...
1
vote
2answers
52 views

Does PCI-DSS require that the telnet client be uninstalled from a server

Often(not always) I see with my clients' PCI vulnerability assessments the telnet client being installed coming up as flagged, for both Windows and Linux based servers. I understand why a telnet ...
4
votes
1answer
53 views

If my company receives credit card statements showing credit card number, does it have to be PCI compliant?

I understand PCI requirements on the storing, processing and transmitting of credit card information (PAN, expiration date, no on CVV, etc.). However, I found nothing about receiving PAN (no ...
1
vote
1answer
26 views

Casual email that includes a P-Card Account number and expiration date - does this violate PCI?

We discovered an email sent from one employee to another "loaning" the second employee the use of their PCARD. Email contained their PAN and expiration date. There is no payment application associated ...
11
votes
1answer
2k views

Properly masking credit cards

I'm wondering if the following masking of credit card would be considered PCI compliant. ######??????#### # Is plaintext ? is redacted Expiration date is available in plaintext Is it ...
0
votes
0answers
46 views

Managed hosting with PCI SAQ D for Service Providers compliance

We have some hotel websites on our current managed hosting that link via URL redirect to a PCI Compliant third party booking engine hosted elsewhere. We do no more than pass date of arrival and number ...
1
vote
1answer
30 views

Can a non-PCI Compliant Service Provider provide SAQ A-EP compliance?

I am trying to find clarification regarding PCI Compliance SAQ A-EP and third party hosting solutions. In order to achieve SAQ A-EP PCI Compliance using "Hosting Company A" is it necessary for "...
2
votes
2answers
91 views

Using browser AJAX to initiate credit card transaction with processor?

Let's say that I have a website where people can make purchases, donations, etc. The entire website is served with https. I store the information regarding the purchases (item, quantity, price) as ...
8
votes
3answers
220 views

A store I visited is breaching PCI DSS. What should I do?

I recently visited a store in Northern Ireland and paid using my Visa debit card. The receipt shows my entire card number and expiry date. It also contains other info. I thought this should all be ...
3
votes
1answer
86 views

Is it PCI compliant to write down credit card information on paper and store it in unattended boxes?

There is a local mom and pop video store that requires new customers to write their names, addresses, and credit card information on 3x5 cards. These cards are actually kept in a recipe cards box that ...
0
votes
1answer
39 views

PCI DSS Scope outside CDE

Our organization is in process of determining if our PCI DSS scope is correct. We have done lots of research and read the Open PCI DSS Scoping Toolkit document. However, we still struggle to fully ...
2
votes
2answers
46 views

Interaction between cash register and card terminal

A store allows you to join their loyalty club by simply presenting an ID and a credit card. Your identity is somehow linked to your card and automatically registered the next time you pay, no extra ...
0
votes
2answers
209 views

Is PIN affective security for credit cards considering it's not always needed?

This question asked about how having a PIN is safer than signing the receipt when doing a credit card transaction (personally the question makes no sense to me as it's just a scientific fact that a ...
1
vote
1answer
52 views

PCI Compliance requirement when storing card data on user's device

I have an application where I take the user to a PCI compliant payment gateway for completing the payment. I want to give the functionality of "Remember my card" so that the user does not have to ...
3
votes
1answer
56 views

Store PCI DSS data in an encrypted form in non PCI DSS scope

Am I allowed to save a strongly encrypted archive containing the CHD on an external storage which is outside our PCI-DSS infrastructure ? For example, we'd like to save an encrypted backup archive ...
1
vote
1answer
21 views

Should EMV data fields be encrypted?

Are there any EMV data fields considered to be sensitive data according to the PCI DSS standard?
3
votes
4answers
73 views

How to be PCI compliant with Shopkeep (and others)?

When I walk into some businesses, I see them using Shopkeep on an iPad. I don't understand how this is PCI compliant, as the iPad itself would be in scope, and it can send unconstrained traffic to ...
1
vote
1answer
41 views

Would the following practice make email PCI compliant?

If a system applied to the following three practice/technologies to each e-mail, would it rate as PCI compliant? The email itself is encrypted Encryption is applied end-to-end in the transport layer ...
0
votes
1answer
42 views

How to export application metrics out of PCI environment

I am building a credit card tokenization/payment-processing service. As these services need sit in pci-compliant environment, I find it hard to export the application metrics & logs. Anyone knows ...
2
votes
2answers
83 views

Is there a difference between getting encryption key versus encrypted data from server in terms of security

Suppose we have web and application servers and trying to encrypt credit card information for our financial web application. Communication between web and app servers are secured through SSL/TLS. Lets ...
0
votes
1answer
89 views

PCI-DSS compliance in scope if part of card number and expiry stored only? [duplicate]

If we were to store the following information about a credit card, would we need to be PCI-DSS compliance or are we out of scope? Please assume for the purposes of this question that we only store ...
5
votes
3answers
224 views

Do you have to ban cellphones and paper to be PCI compliant?

Today I heard of a call centre that you are not allowed to bring cellphones into or take paper out of. This is allegedly to be PCI complaint. Is this true? What is the reasoning? This seems like ...
0
votes
1answer
52 views

How Point-to-Point encryption eliminates PAN storing? [closed]

Encrypted Primary Account Numbers (PAN) are stored without any personal info. The intention is to tie it for the refunds purposes. To move to a PCI-DSS environment, a vendor recommends moving to P2PE ...
2
votes
1answer
149 views

HTTPS iFrame embedded in HTTP page - PCI implications?

I'm currently volunteering at a nonprofit. While researching something unrelated, I noticed that a $sisteragency was using an embedded iFrame to accept online donations. While the frame's source uses ...
-1
votes
1answer
42 views

Studying to become a ASV, need some guidence

I have completed the online training/exam to become an ASV (Approved Scanning Vendor) for my company. We currently have Nessus as our platform, and I am not feeling too great about it's capabilities. ...
0
votes
0answers
50 views

Handling Credit Card info in Source Code

Background Info I am using an API to make donation to charities (First Giving API). The API only supports credit card info for making a donation. Due to the requirements of the application, donors ...
3
votes
3answers
66 views

Boundaries of Personally Identifiable Information - PCI-DSS

I am attempting to ascertain the boundaries of personally identifiable information. For example does the combination of John and Doe equate to personally identifiable information since there could ...
1
vote
1answer
48 views

Call recording PCI-DSS issues

For a non-automated payment card entry system, if a caller is providing a payment card details over the phone to a call centre employee who confirms the number to the caller, does that mean the ...
4
votes
0answers
38 views

Major UK company seems to be handling customer & card data recklessly [duplicate]

A company I used to work for is passing customer's personal details as well as card data (number, expiration date, name, CVV2 and the contents of the magstripe thanks to a reader) through Windows XP ...
1
vote
0answers
42 views

Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc

Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the ...
3
votes
1answer
32 views

ASV scan - What to expect from external scan services?

We've been asked to perform a vulnerability scan in our servers which process transactions with payment cards as a requirement for PCI compliance. PCI DSS mandates this scan must be done by a ASV. ...
2
votes
1answer
35 views

What is the difference between PCI-DSS compliance and certification?

PCI-DSS compliance and certification appears to be used interchangeably however it isn't clear what the differences are. For example if you are certified does it mean you are compliant and if you ...
3
votes
3answers
254 views

Creditcard store first six digits PCI reference

I need to store masked PAN with first six digits and last four digits along with the card expiry month and year. Is it safe to do it according to the PCI rules? Regarding four digits has been ...
3
votes
1answer
105 views

Unable to completely enforce password policy

PCI DSS has a few requirements regarding the password policy (like remember last four passwords, change password every 90 days, use at least seven numeric and alphabetic characters and more). These ...
2
votes
1answer
134 views

PCI DSS placement of puppet (or chef) server?

I'm puzzled as to whether I am allowed to set up a puppet server in a PCI DSS environment, and if I am, where should it be located? I was planning on installing it on gateway, and all the hosts would ...
1
vote
0answers
20 views

PCI-DSS Helping customers with a third-party booking service

My clients are able to pay for services through a website EXAMPLE.COM. Sometimes, a client will call on the phone looking to pay for services over the phone. I would like to use a device to visit ...
0
votes
1answer
67 views

Storing last 6 digits of payment card vs 4 digits

I am wondering what are the risks associated with storing last 6 digits of a payment card as compared to the last 4 digits. In addition, will it have implications on PCI DSS compliance?
0
votes
1answer
110 views

PCI check failing

I have had a customer come to me with a failed PCI compliance check with the failure apparently caused by an extension I develop. The scenario is that web page content is served by the extension but ...
1
vote
2answers
41 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
1
vote
0answers
36 views

SAQ D PCI Compliance for Custom Shopping Cart

We use a custom developed open-source e-commerce software. We are SAQ D and I am trying to figure out which of these requirements applies to our cart if: We aren't storing credit card information We ...
2
votes
1answer
73 views

PCI Scope, Tokens, and Processor APIs

A merchant receives a processor provided payment token in response to an authorization from an online order (for the sake of this question assume this part of the process has all its PCI t-s crossed ...
5
votes
3answers
838 views

Cardholder data segmentation for PCI compliance (3.2)

We are currently collecting card holder data in a segmented way. Our system is used by call center agants which I will refer to as channel B Over channel A (mobile carrier) we collect the first 8 ...
1
vote
1answer
109 views

PCI: Does CHD or SAD still need to be protected after implementing a P2PE solution?

The promise of a good (even certified) PCI P2PE v2 solution is that the merchant does not have access to the keys which encrypted the Card Holder Data (CHD) and the Sensitive Authentication Data (SAD) ...
3
votes
1answer
44 views

PCI definition of “store”

In the PCI DSS 3.1 requirements, the term "store" is used often. For example requirement 3.2 says "Do not store sensitive authentication data after authorization (even if encrypted)..." Does this ...
0
votes
2answers
162 views

How to prevent sysadmins tampering with code?

Let's say you have some sensitive user data you need to protect (e.g., for PCI compliance) and you have done this by having the server code encrypt it before storing it in a separate server where no ...
0
votes
1answer
38 views

What type of 'security scan' does a PCIDSS compliance check comprise?

Our firm processes CC information on an ad hoc basis. No cardholder data is ever recorded in any of our databases and we do not grant public access to any of our database or business application ...
0
votes
0answers
51 views

Data Model for a Tokenizing Data Storage System

Hashing Strategy for a Tokenizing Data Storage System We are designing the data model (storage at rest, in a database) for a PCI compliant data storage system using Amazon Web Services (AWS) and ...
7
votes
2answers
160 views

Is PCI-DSS Compliance Required with PayPal Donate/Payment Buttons on Websites?

Reading about PCI-DSS 3 recently: Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website? ...
3
votes
1answer
92 views

PCI DSS compliant without private VLAN

I understand that it may be a best practice to hide in-PCI-scope-elements like databases inside a VLAN without a public address and also strict firewall rules. However, my questions is: can ...