Question 1

Who is required to comply with PCI DSS in Malaysia?

Accepted Answer

Any merchant, payment gateway, fintech, or service provider that stores, processes, or transmits Payment Card Industry (PCI) cardholder data or sensitive authentication data must comply with PCI DSS v4.0.

Question 2

What are the four PCI DSS merchant levels?

Accepted Answer

Merchant levels are determined by annual transaction volume: Level 1 (over 6 million transactions annually), Level 2 (1 to 6 million), Level 3 (20,000 to 1 million e-commerce transactions), and Level 4 (fewer than 20,000 e-commerce or up to 1 million total transactions).

Question 3

How can network segmentation reduce PCI DSS audit scope?

Accepted Answer

Properly configured network segmentation isolates the Cardholder Data Environment (CDE) from out-of-scope corporate networks using firewalls and strict access controls, significantly reducing the number of systems subject to annual assessment.

Question 4

What are the requirements for PCI ASV quarterly scans?

Accepted Answer

External-facing IP addresses and domains in scope for PCI DSS must undergo vulnerability scans conducted by a PCI SSC-Approved Scanning Vendor (ASV) at least once every 90 days, with all vulnerabilities scored CVSS 4.0 or higher remediated.

PCI DSS compliance

Complete payment security support

Assessment

Technical testing

Remediation

Frequently asked questions

Protect cardholder data

Not sure what you need?