PCIP Compliance Reporting 3

Question 1

Which SAQ type applies to merchants who only use payment terminals connected to a payment processor via IP with no electronic cardholder data storage?

Accepted Answer

SAQ B-IP

Answer

SAQ B-IP applies to merchants using standalone IP-connected payment terminals that do not store electronic cardholder data.

Question 2

What is the compliance reporting obligation for a newly identified service provider that stores cardholder data?

Accepted Answer

They must begin working toward compliance immediately and report by the acquirer's deadline

Answer

Newly identified service providers must begin PCI DSS compliance efforts immediately and meet reporting deadlines set by their acquiring bank or card brand.

Question 3

When a QSA marks a requirement as 'Not Applicable' in the ROC, what must also be documented?

Accepted Answer

The justification explaining why the requirement does not apply

Answer

When a requirement is marked Not Applicable, the QSA must document the specific justification for why the requirement does not apply to the assessed environment.

Question 4

A merchant discovers they are out of compliance after completing their annual SAQ. What is the correct first step?

Accepted Answer

Inform their acquiring bank and develop a remediation plan

Answer

Upon discovering non-compliance, merchants must notify their acquirer and work with them to develop an acceptable remediation plan with defined timelines.

Question 5

Which card brand requires all Level 1 service providers to be listed on its public registry of compliant service providers?

Accepted Answer

Both Visa and Mastercard

Answer

Both Visa and Mastercard maintain public registries of compliant service providers, and Level 1 service providers must be listed to demonstrate compliance.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Compliance Reporting 3