During PA-DSS assessment, assessor must validate installation per which guide?

• A. The PA-DSS implementation guide provided by the payment application vendor
• B. The PCI DSS implementation guide
• C. The P2PE implementation guide
• D. The HSM installation guide

Answer: (A)

During a PA-DSS assessment, the installation must be validated against the vendor’s PA-DSS Implementation Guide. This guide specifies the exact installation and configuration steps the payment application must follow to remain PA-DSS compliant, ensuring the app is deployed securely and handles cardholder data according to the standard. Other guides address different scopes: a general PCI DSS implementation guide covers broader security requirements for the environment, not the specific payment application; a P2PE implementation guide focuses on point-to-point encryption solutions; and an HSM installation guide pertains to hardware security modules rather than the application itself.