Before you go on-site, the vendor’s primary contact communicates a legitimate reason for delaying the assessment for several months. Who can approve…

The payment brands (e.g., Visa, Mastercard, American Express) are responsible for managing their respective cardholder data security and compliance programs. They set the rules, validation requirements, and reporting deadlines for entities within their ecosystem. While the PCI Security Standards Council (SSC) develops and maintains the standards, it does not manage individual entity compliance or enforcement. Therefore, any request for a delay or change in the assessment reporting schedule must be directed to and approved by the relevant payment brand(s) that require the assessment from the vendor.

A. Vendor senior management can request a delay but lacks the authority to approve a change to a compliance deadline imposed by the payment brands.

C. Affected issuers (card-issuing banks) are consumers of the vendor's services but do not manage the vendor's compliance validation schedule.

D. The PCI SSC is a standards body; it develops the PCI standards but does not manage compliance programs, enforcement, or assessment deadlines for individual entities.

1. PCI Security Standards Council, "About Us" page. The official website clarifies the roles: "It's important to note that the PCI Security Standards Council is responsible for managing the security standards, while compliance with the PCI Security Standards is enforced by the major payment card brands..." This delineates the responsibility for compliance management, including schedules, to the payment brands, not the SSC. (Source: https://www.pcisecuritystandards.org/aboutus/)

2. PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms, v3.2.1, Page 22. The definition for "Payment Brand" states: "The payment brands are responsible for managing compliance with the PCI DSS." This explicitly assigns the responsibility for compliance management, which includes reporting schedules, to the brands.

3. Visa Inc., "Visa Core Rules and Visa Product and Service Rules," 19 October 2023, Section 2.1.3.1 "PCI DSS Validation." This document outlines that entities must "annually validate and demonstrate its PCI DSS compliance status to Visa" and that "Visa may, at its discretion, require more frequent validation." This demonstrates that Visa (a payment brand) controls the validation requirements and timing.