Maestro Global Rules (PDF) - MasterCard

Security
8.10 Site Data Protection Program
a. Any Merchant having greater than 20,000 total combined MasterCard
and Maestro e-commerce Transactions annually but less than or equal
to one million total combined MasterCard and Maestro e-commerce
transactions annually; and
b. Any Merchant meeting the Level 3 criteria of Visa.
To validate compliance, Level 3 Merchants must successfully complete:
a. An annual self-assessment; and
b. Quarterly network scans conducted by a PCI SSC ASV.
4. Level 4 Merchants
Any Merchant not deemed to be a Level 1, Level 2 or Level 3 Merchant is
deemed to be a Level 4 Merchant. Compliance with the Payment Card
Industry Data Security Standard is required for Level 4 Merchants; however
validation of compliance (and all other MasterCard SDP Program Acquirer
requirements set forth in Rule 8.10) is optional. However, a validation of
compliance is strongly recommended for Acquirers with respect to each
Level 4 Merchant in order to reduce the risk of Card data compromise and
for an Acquirer to potentially gain a partial waiver of related assessments.
To validate compliance with the Payment Card Industry Data Security
Standard, Level 4 Merchants must successfully complete:
a. An annual self-assessment; and
b. Quarterly network scans conducted by a PCI SSC ASV.
If a Level 4 Merchant has validated its compliance with the Payment Card
Industry Data Security Standard and effective 1 July 2012, the Payment
Card Industry Payment Application Data Security Standard as described
in this section, the Acquirer may, at its option, fulfill the reporting and
requirements described in Rule 8.10.4 of this rulebook.
8.10.5.2 Service Providers
Effective 1 July 2012, all Service Providers that use any third party-provided
payment applications must validate that each payment application used is listed
on the PCI Security Standards Council Web site at www.pcisecuritystandards.org
as compliant with the Payment Card Industry Payment Application Data
Security Standard, as applicable. The applicability of the PCI PA-DSS to third
party-provided payment applications is defined in the PCI PA-DSS Program
Guide.
1. Level 1 Service Providers
A Level 1 Service Provider is any TPP (regardless of volume) and any
DSE that stores, transmits, or processes more than 300,000 total combined
MasterCard transactions and Maestro Transactions annually.
©1993–2012 MasterCard. Proprietary. All rights reserved.
Maestro Global Rules • 9 November 2012 8-23