PCI SSC Trademark Usage Guidelines

(as of September 26th, 2017)
PCI Security Standards Council, LLC (“PCI SSC”) is an open global forum engaged in the ongoing development, enhancement, dissemination, and implementation of payment card industry security standards. PCI SSC’s mission is to enhance payment account data security by driving education and awareness of its various standards, including its Payment Card Industry (PCI) Data Security Standard (PCI DSS).

Among other things, PCI SSC operates various qualification programs (each a “Qualification Program”) under which security solution providers (or products or solutions thereof) may achieve and maintain corresponding qualifications granted by PCI SSC (each a “Qualification”). Examples include qualifications under corresponding PCI SSC programs for Qualified Security Assessor (QSA) companies, Approved Scanning Vendor (ASV) companies, QSA Point-to-Point Encryption (QSA (P2PE)) companies, Payment Card Industry Professionals (PCIPs)™, Qualified Integrators and Resellers (QIRs)™, Internal Security Assessor (ISA) Sponsor companies, PCI Forensic Investigator (PFI) companies, and others. Additionally, PCI SSC offers eligible companies the opportunity participate in its Participating Organization program (together with the Qualification Programs, the “Programs” and each a “Program”).

As part of each Program, eligible participants are permitted to use corresponding Program trademarks specifically designated by PCI SSC for that purpose, subject to the terms of a corresponding “Trademark License Agreement” between PCI SSC and such participant (each an “Agreement”) and compliance with the then current version of these PCI SSC Trademark Usage Guidelines (the “guidelines”).

The guidelines are incorporated into each Agreement, and provide standards that each Program participant (each a “User”) must follow when using any “Mark” (as defined in the applicable Agreement).  Capitalized terms used in these guidelines without definition have the meanings set forth in the applicable Agreement.

I.          GENERAL PROVISIONS

These guidelines are intended for all Users of any Mark in any media, including but not limited to printed materials, products, software, the Internet, and advertising.

II.        USAGE GUIDELINES

A.         Proper Form and Usage

1.   General

a. The approved format for presentation of each Mark is provided on the corresponding Logo Page, and may from time to time be amended and revised by PCI SSC in its sole discretion.

b. No Mark may be incorporated into or combined with any other Mark, trade name, trademark, service mark, certification mark, other words, letters, images, or the name of any product, service, company, domain, etc.

c. Each Mark and the arrangement of type and shapes therein must not be altered or modified in any way.

d. The Marks must not be used with any parentheses, comma, or other punctuation, except to the extent included in the applicable Mark as provided by PCI SSC.

e. When using a Mark, the Mark must appear (i) with the appropriate trademark symbol, as it appears with the Mark as provided by PCI SSC on the Logo Page and (ii) on the most prominent (or if none is prominent, the first) appearance of that Mark on the applicable User materials.

f. When using a Mark in or on materials in conjunction with a product, service or third party name, the name of the product, service or third party should appear in a prominent location on all materials to make it clear that PCI SSC is not the product or service provider or the author of the materials.

g. If the Logo Page lists more than one Word Mark, users are strongly encouraged to use the first Word Mark appearing in the list, in preference to the other listed Word Marks.

2.   Graphic Logos

a. The graphic logo form of a Mark (a “Logo”) must always be shown in the same colors, typography and proportions as it is made available by PCI SSC.

b.  Logos must be no larger than 30% of the size of the User’s own trademarks, service marks or similar designations in the applicable materials or product.

c.   To ensure legibility and visual presence, Logos must never appear smaller than 10% of the size of the User’s own trademarks, service marks or similar designations in the applicable materials or product.

d.   Users must maintain minimum clear space around each Logo equal to 1/4 the height of the Logo, applied in all directions around the Logo.  No text or graphic elements may appear inside this clear space area.

B.         Attribution; Ownership; Other Guidelines

1.   Attribution

a. When referencing or using a Mark in any website, promotional materials, product, marketing or advertising materials, or other documentation, proper ownership of the Mark must be attributed to PCI SSC in a clearly visible manner.  An ownership attribution legend should conspicuously appear on the same page, if practicable, or on the face of any materials where a Mark appears, in the following format: “The [name of mark] mark [and logo, if applicable] [is / are] a trademark or service mark of PCI Security Standards Council, LLC in the United States and in other countries and is being used herein under license.”

b. When use of any Mark is on a website, the ownership reference must include a link to PCI SSC’s website at www.pcisecuritystandards.org.

c. When referring to PCI SSC on a website or in other documents of mass communication, including marketing collateral, Users must use “PCI Security Standards Council, LLC” as the first reference to PCI SSC therein.

2. Ownership

a.   PCI SSC is the exclusive owner of the Marks and is solely entitled to claim ownership of and register the Marks.

b.   No person or entity is permitted to register or use any trademark, service mark, certification mark, company name, trade name or domain name that incorporates any Mark or the combination of letters found in any Mark or in “PCI SSC” or “PCI Security Standards Council”.

c.   Users must not create alternative word marks or logos to indicate or imply compliance with PCI SSC standards or requirements or receipt of PCI SSC approval, qualification, certification or accreditation, even if the User has received a PCI SSC approval, qualification, certification or accreditation.  Only the applicable Marks as provided by PCI SSC are permitted to be used for this purpose, and then, only in accordance with the applicable Agreement and the guidelines.

3. Other Guidelines

a. All User products and services must be marketed under the User’s own non-PCI SSC product names and brands.

b.   No entity or person may refer to any Marks or any Qualification in a manner that might tend to be misleading.  For example, product providers whose products have not received a Qualification should not state that their products were “designed for” PCI SSC or are “PCI-compliant” or “DSS-compliant” or “Certified”, or use similar descriptions, as such statements might mislead consumers into believing mistakenly that the products or services have received a Qualification that they have not.

c.   Any claim that a particular product, service or User is PCI SSC qualified, or has received a given Qualification should be verifiable by requesting from the product or service provider a copy of the applicable Qualification materials/letter, and/or by checking the status of the product, service or User on the public PCI SSC website.

d.   Newspapers, magazines, television and other news or press organizations that use any of the Marks in news reports must do so only in accordance with these guidelines.

C.         PCI SSC Logo and PCI SSC Word Marks

The “PCI SSC Word Marks” identified below are word marks that are owned and to be used exclusively by PCI SSC.  Additionally, PCI uses a specific graphic logo to reference PCI SSC (the “PCI SSC Logo”, U.S. Reg. No. 3,694,300 and U.S. Reg. No. 4,340,107), which is owned and to be used exclusively by PCI SSC. 

PCI SSC Word Marks: “PCI SSC” and “PCI Security Standards Council”

No rights are granted herein or pursuant to the Agreement or otherwise to use or reproduce the PCI SSC Logo or either of the PCI SSC Word Marks. Users are expressly prohibited from reproducing or otherwise using the PCI SSC Logo or either of the PCI SSC Word Marks without separate prior written permission from PCI SSC in each instance.

III.       PROCESS FOR REPORTING POTENTIAL VIOLATIONS

Potential infringements and/or misuses of any of the Marks include, but are not limited to:

- Use in connection with any product or service claiming or implying PCI SSC qualification, acceptance or approval, at any time while the applicable Qualification is not in effect or is not in good standing

- Use in connection with any product or service claiming or implying PCI SSC qualification, acceptance or approval, prior to successfully completing the applicable Qualification process

- Use in any company name, trade name, domain name, product name or service name or logo

- Failure to properly attribute ownership to PCI SSC in accordance with these guidelines when a Mark is used

- Failure to properly display the Mark in accordance with these guidelines when a Mark is used

All potential infringements and misuses of any of the Marks, including without limitation, the above, should be reported to PCI SSC.

If you have any questions regarding these guidelines, please contact info@pcisecuritystandards.org.