PCI SSCPCI DSSCompliance ReportingEASYFree question
Who determines the compliance validation level for a merchant?
- A.The payment brand (such as Visa, Mastercard) and/or the acquiring bank determine the validation level based on transaction volume
- B.The PCI SSC (such as through its QSA program) and the QSA decide the level, based on the merchant's size
- C.The issuing bank (such as the cardholder's own bank) and the ASV set the level, based on scan failures
- D.The merchant's QSA (such as a firm engaged for the ROC) and the processor choose the level, based on headcount
Why A is correct
Payment brands and acquiring banks determine a merchant's compliance validation level, typically based on annual transaction volume, with different requirements for each level.
Know someone studying for PCI DSS? Send them this one.