Frequently Asked Questions

< Back to search page

Can a QSA that is not also a P2PE Assessor validate an encryption solution meets P2PE Requirements?

FAQ Response

No. Only P2PE Assessors are qualified by the PCI Council to evaluate P2PE Solutions, P2PE Components and P2PE Applications. Note that only a QSA (P2PE) is qualified to evaluate P2PE Solutions (including Merchant-Managed Solutions) and P2PE Components, while a PA-QSA (P2PE) is additionally qualified to evaluate P2PE Applications.

June 2016
Article Number 1246

Related Articles

What effect does the use of a PCI-listed P2PE solution have on a merchant’s PCI DSS validation?

Who can use SAQ P2PE?

How do PCI PTS-approved POI device expiry dates affect a PCI-listed P2PE solution?

Are P2PE Products (P2PE Solutions, P2PE Components, P2PE Applications) on the P2PE Expired Listings still considered “validated” per the P2PE Program Guide?

If a P2PE Solution is on PCI’s list of Point-to-Point Encryption Solutions with Expired Validations, does the solution meet the eligibility criteria for SAQ P2PE?