Frequently Asked Questions
Do ISPs that provide only internet connection need to comply with the PCI DSS?
FAQ Response
If the ISP only provides a “pipe” for internet access, then it is not considered a service provider and is not subject to PCI DSS compliance. However, if the ISP is providing additional services such as firewalls or hosting functions, it is considered a service provider and would need to comply with the PCI DSS.
March 2009
Article Number 1044