PCI DSS: Visa and MasterCard Quick Reference Guide

Merchant, Service Provider and Compliance Level 1

Merchant Qualification Criteria for Visa and MasterCard:

• Retail and eCommerce Merchants with greater than 6 million Visa and MasterCard transactions annually.
• Merchants that have suffered a hack or an attack that resulted in an account data compromise.
• Merchants that Visa and MasterCard determines should meet the Level 1 merchant requirements to minimize risk to the Visa system, or merchants identified by any other payment card brand as Level 1.

Service Provider Qualification Criteria:

• Visa-All VisaNet processors (member and Nonmember) and all payment gateways--agent or service provider that stores, processes, and/or transmits cardholder data as part of a payment transaction.
• MasterCard-All TPPs and DSE's that store account data on behalf of Level 1 or Level 2 merchants.

Validation Requirement:

• Visa-- Annual onsite review by a QSA or Internal Audit if signed by Officer of the company, and a quarterly network security scan with an ASV.
• MasterCard-Annual onsite review by merchant's internal auditor or a Qualified Security Assessor (QSA), and a quarterly network security scan with an Approved Scanning Vendor (ASV).

Deadline: September 30, 2007

Merchant, Service Provider and Compliance Level 2

Merchant Qualification Criteria:

• E-Commerce merchants with 150,000 to 6 million Visa or MasterCard transactions annually.
• All merchants meeting the Level 2 criteria of a competing payment brand.

Service Provider Qualification Criteria:

• Visa--Any service provider that is not in Level 1 and stores, processes, or transmits more than 1,000,000 Visa accounts/transactions annually.
• MasterCard--Includes all those DSEs that store account data on behalf of level 3 merchants.

Validation Requirement:

• Visa-Annual onsite review by QSA and quarterly network security scan with an approved ASV.
• MasterCard-- Annual onsite review by QSA and quarterly network security scan with an approved ASV.

Deadline: December 31, 2007

Merchant and Service Provider Compliance Level 3

Merchant Qualification Criteria:

• Visa-Merchants with annual e-commerce transactions greater than 20,000 but less than one million total transactions.
• MasterCard-Merchants with annual e-commerce transactions greater than 20,000 but less than one million total transactions, and all merchants meeting the Level 3 criteria of a competing payment brand.

Service Provider Qualification Criteria:

• Visa- Any service provider that is not in Level 1 and stores, processes, or transmits more than 1,000,000 Visa accounts/transactions annually.
• MasterCard-All other DSEs not included in Levels 1 and 2.

Validation Requirement:

• Visa-Completion of PCI DSS Self Assessment Questionnaire and quarterly network security scan with an approved ASV.
• MasterCard-Completion of PCI DSS Self Assessment Questionnaire and quarterly network security scan with an approved ASV.

Deadline: Contact acquirer or card brand representative.

Merchant and Service Provider Compliance Level 4

Merchant Qualification Criteria:

• Visa-Merchants processing fewer than 20,000 Visa e-commerce transactions per year, and all other merchants regardless of acceptance channel processing up to 1,000,000 Visa transactions per year. Completion of PCI DSS Self Assessment Questionnaire annually, and quarterly network security scan with an approved ASV. Acquirer submits summary of PCI compliance plan to Visa by July 30, 2007. If a breach has been reported, or found, Visa reserves the right to move the Level 4 merchant to a Level 1. If so, the Level 4 merchant must abide by the Level 1 validation requirements. (See Level 4 Merchant Compliance for more information).
• MasterCard-Any other merchant not covered in Level 1, Level 2 and Level 3 compliance qualifications. " Validation Requirement:
• Visa--Completion of PCI DSS Self Assessment Questionnaire and quarterly network security scan with an approved ASV. Complete a
• MasterCard-Completion of PCI DSS Self Assessment Questionnaire and quarterly network security scan with an approved ASV.

Deadline: Summary of PCI compliance plan, via acquirer, by July 30, 2007.

Suggested Links:

• https://www.pcisecuritystandards.org/pdfs/pci_saq_v1-0.pdf
• https://www.pcisecuritystandards.org/pdfs/pci_dss_v1-1.pdf
• http://usa.visa.com/merchants/risk_management/cisp_merchants.html?it=l2|/merchants/risk_management/cisp.html|Merchants
• http://usa.visa.com/merchants/risk_management/cisp_service_providers.html?it=l2|/merchants/risk_management/cisp_merchants.html|Service%20Providers
• http://www.mastercard.com/us/sdp/merchants/merchant_requirements.html
• http://www.mastercard.com/us/sdp/serviceproviders/serviceprovider_requirements.html

                    

Print this page

Send this page to a friend

PCI DSS: 5 Guidelines for Gaining PCI Compliance Step 1: An Introduction to PCI Compliance PCI Compliance Introduction Who Put the DSS in PCI? Step 2: Finding The PCI DSS Merchant, Service and Compliance Level Should Your Organization be Concerned about PCI Compliance? PCI DSS: The Visa CISP Program MasterCard SDA Program Defining Merchant Validation Levels Level 4 Merchant Compliance Visa PCI CAP Program Defining Service Provider Validation Levels Acquirer Responsibility Calculating Merchant Transactions PCI DSS: Visa and MasterCard Quick Reference Guide Step 3: Attaining PCI DSS Compliance-Merchant Security Audits: 12 Requirements Build and Maintain a Secure Network Protect Cardholder Data Maintain a Vulnerability Management Program Implement Strong Access Control Measures Regularly Monitor and Test Networks Step 4: Finding a PCI DSS Approved Scanning Vendor (ASV) Do You Need an ASV? Merchant and Service Provider Scanning Requirements Compliance Reporting Visa and Compliance Reporting MasterCard and Compliance Reporting Step 5: Completing the PCI DSS Self Questionnaire Completing the PCI DSS Self Questionnaire PCI Compliance Polls Are you currently PCI Compliant? Yes No Working towards compliance Why are you looking at PCI Compliance Required By Credit Card Processor Required By Bank Want to meet industry standards Looking to secure network What merchant level do you fall under for PCI Compliance? Level 1 Level 2 Level 3 Level 4 I have no idea View PCI Merchant Level Results View All PCI Compliance Poll Results EV SSL Certificate Guide Sponsored Listing: