Security Rules and Procedures—Merchant Edition • 22 February 2022

At the conclusion of the forensic investigation, Mastercard will provide a Mastercard Site Data Protection (SDP) Account Data Compromise Information Form for completion by the compromised entity itself, if the compromised entity is a Service Provider, or by its Acquirer, if the compromised entity is a Merchant. The form must be returned by email message to pci_adc@mastercard.com within 30 calendar days of its receipt, and must include:

• The names of the the forensic investigator, QSA and the Approved Scanning Vendor (ASV);
• The entity’s current level of compliance; and
• A gap analysis providing detailed steps required for the entity to achieve full compliance. As soon as practical, but no later than 60 calendar days from the conclusion of the forensic nvestigation, the compromised entity or its Acquirer must provide evidence from a QSA and an ASV that the compromised entity has achieved full compliance with the PCI DSS and if applicable, the PCI TSP Security Requirements or the PCI 3DS Core Security Standard. Such evidence (a completed PCI DSS AOC produced after a successful PCI DSS assessment resulting in the completion of a ROC conducted by a PCI SSC- approved QSA and a network scan AOC conducted by a PCI SSC-approved ASV) must be submitted to Mastercard by email message to pci_adc@mastercard.com. Failure to comply with these requirements may result in SDP noncompliance assessments as described in section 2.2.5. Any Merchant that has suffered a confirmed ADC Event will be automatically reclassified to become a Level 1 Merchant. Any Service Provider that has a confirmed ADC Event, adverse inference (see section 10.3), and/or noncompliance for failure to cooperate in an ADC Event or forensic investigation will be automatically reclassified to become a Level 1 Service Provider. In addition, if the compromised entity is a Service Provider, the Service Provider must demonstrate to Mastercard its compliance with the DESV appendix of the PCI DSS within twelve (12) months from achieving full compliance with the PCI DSS. NOTE: A confirmed ADC Event, adverse inference, and/or noncompliance for failure to cooperate in an ADC Event or forensic investigation will result in the automatic delisting of a Service Provider from The Mastercard SDP Compliant Registered Service Provider List. A registered Service Provider may be placed back on the list only after the entity has re- validated compliance with the PCI DSS and has additionally demonstrated compliance with the DESV appendix of the PCI DSS. Cybersecurity Standards and Programs