Frequently Asked Questions

< Back to search page

Can I combine sections from different versions of the PA-DSS?

FAQ Response

No.  When validating payment application compliance through a Report on Validation (ROV) you may not 'combine' requirements from multiple versions of the standard – your assessment must be to one version in its entirety. Please also note that PA-DSS validations must follow the instructions in the corresponding Program Guide.  For example, applications validated under PA-DSS version 2 must use version 2.x of the PA-DSS Program Guide, and version 3.x validations must use PA-DSS Program Guide version 3.x.

June 2016
Article Number 1271

Related Articles

If a merchant develops an application that runs on a consumer’s device (e.g. smartphone, tablet, or laptop) that is used to accept payment card data, what are the merchant’s obligations regarding PCI DSS and PA-DSS for that application?

What is the Council’s guidance on the use of SHA-1?

Does PCI DSS, PA-DSS, or PTS apply to ATMs?

How does use of an expired PTS device affect my PCI DSS compliance?

What is the difference between a Validated Payment Application which is shown on the PCI SSC website as “Acceptable for New Deployments” and one which is shown as “Acceptable only for Pre-Existing Deployments”?