| Level |
Selection Criteria |
Validation Actions |
Validation Process |
Merchant Requirements |
 |
| 1 |
 |
6 million annual Visa or MC trans.
(all acceptance channels) |
|
Incurred a compromise |
|
|
Annual onsite security visit |
| - and - |
|
Quarterly network scan |
|
Qualified Independent Security Assessor or Internal Audit Staff with CISA designation if signed by company
officer |
|
Submission of successful Report on Compliance (ROC) |
|
Quarterly scan showing no high vulnerabilities |
|
|
| 2 |
1 million to 6 million annual Visa or MC trans.
(all acceptance channels) |
|
Annual PCI self-assessment questionnaire |
| - and - |
|
Quarterly network scan |
|
|
Validated by merchant |
|
Qualified independent scan vendor |
|
|
Submission of PCI self-assessment questionnaire with green rating |
|
Results of quarterly scan showing no high vulnerabilities |
|
|
| 3 |
20,000 - 1 million
Visa or MC
e-commerce trans. |
|
Annual PCI self-assessment questionnaire |
| - and - |
|
Quarterly network scan |
|
|
Validated by merchant |
|
Qualified independent scan vendor |
|
|
Submission of PCI self-assessment questionnaire with green rating |
|
Results of quarterly scan showing no high vulnerabilities |
|
|
| 4 |
Others
(regardless of acceptance channel) |
|
Recommended annual PCI self-assessment questionnaire |
| - and - |
|
Recommended quarterly network scan |
|
|
Validated by merchant |
|
Qualified independent scan vendor |
|
|
Compliance mandatory |
|
Validation optional |
|
