The Mastercard Cybersecurity Incentive Program (CSIP) provides eligible Merchants using secure technologies such as EMV chip technology, a PCI-listed point-to-point encryption (P2PE) solution, an MPOS EMV acceptance solution such as SPoC, CPoC or MPoC, or EMV payment tokenization increased flexibility within the SDP Standards. The CSIP ¶ is a component of the SDP Program and is optional for Merchants. The CSIP incentivizes ¶ Merchant participation by either reducing PCI compliance validation requirements or by ¶ eliminating the requirement to annually validate compliance with the PCI DSS. Cybersecurity Standards and Programs Level 1 Service Providers Security Rules and Procedures—Merchant Edition • 6 August 2024 Mastercard PCI DSS Risk-based Approach A qualifying Level 1 or Level 2 Merchant located outside of the U.S. Region may use the Mastercard PCI DSS Risk-based Approach, which reduces a Merchant’s Merchant's compliance requirements to validating compliance with the first two of the six total milestones set forth in the PCI DSS The Prioritized Approach, Approach to Pursue PCI DSS Compliance, as follows: ¶ Cybersecurity Standards and Programs ¶ Level 2 Service Providers ¶ Security Rules and Procedures—Merchant Edition • 6 February 2024 • A Level 1 Merchant must validate compliance through a PCI DSS assessment resulting in the completion of a ROC conducted by a PCI SSC-approved QSA or PCI SSC-certified ISA; • A Level 2 Merchant must validate compliance through an SAQ. Level 2 Merchants completing SAQ A, SAQ A-EP or SAQ D must additionally engage a PCI SSC-approved QSA or PCI SSC- certified ISA for compliance validation; and • Each Level 1 and Level 2 Merchant must annually re-validate compliance with milestones one and two using an SAQ. To qualify as compliant with the Mastercard PCI DSS Risk-based Approach, a Merchant must satisfy all of the following: • The Merchant must certify that it is not storing Sensitive Authentication Data. • On a continuous basis, the Merchant must keep fully segregated the “Card-not-present” "Card-not-present" Transaction environment from the “face-to-face” "face-to-face" Transaction environment. A face-to-face Transaction requires the Card, the Cardholder, and the Merchant to all be present together at the time and place of the Transaction. • For a Merchant located in the Europe Region, at least 95 percent of the Merchant’s Merchant's annual total count of Card-present Mastercard and Maestro Transactions must occur at Hybrid POS Terminals. • For a Merchant located in the Asia/Pacific Region, Canada Region, Latin America and the Caribbean Region, or Middle East/Africa Region, at least 75 percent of the Merchant’s annual total count of Card-present Mastercard and Maestro Transactions must occur at Hybrid POS Terminals. • The Merchant must not have experienced an ADC Event or Potential ADC Event within the last 3 years, including but not limited to outstanding liabilities or actions preventing complete closure of ADC Event. At the discretion of Mastercard, this and other criteria may be waived if the Merchant validated full PCI DSS compliance at the time of the ADC Event or Potential ADC Event. • The Merchant must establish and annually test an ADC Event incident response plan. Information For information about the PCI DSS Prioritized Approach, refer to The Prioritized Approach to Pursue PCI DSS Compliance, which is available at: ¶ https://www.pcisecuritystandards.org/document_library on the PCI SSC website from the Document Library page. Mastercard PCI DSS Compliance Validation Exemption Program All qualifying Merchants may participate in the Mastercard PCI DSS Compliance Validation Exemption Program (Exemption Program), which exempts the Merchant from annually validating its compliance with the PCI DSS. DSS, unless a Merchant's participation conflicts with applicable law or regulation requiring such validation. Cybersecurity Standards and Programs Mastercard PCI DSS Risk-based Approach Security Rules and Procedures—Merchant Edition • 6 August 2024 To qualify or remain qualified to participate in the Exemption Program, a duly authorized and empowered officer of the Merchant must certify to the Merchant’s Merchant's Acquirer in writing that the Merchant has satisfied all of the following: 1. The Merchant does not store Sensitive Authentication Data. The Acquirer must notify Mastercard through compliance validation reporting of the status of Merchant storage of Sensitive Authentication Data; ¶ Cybersecurity Standards and Programs ¶ Mastercard PCI DSS Compliance Validation Exemption Program ¶ Security Rules and Procedures—Merchant Edition • 6 February 2024 2. The Merchant has not been identified by Mastercard as having experienced an ADC Event or Potential ADC Event during the prior three years, including but not limited to outstanding liabilities or actions preventing complete closure of ADC Event; 3. The Merchant has established and annually tests an ADC Event incident response plan in accordance with PCI DSS requirements; and 4. The Merchant has satisfied one of the following: a. At least 75 percent of the Merchant’s Merchant's annual total acquired Mastercard and Maestro Transaction count is processed through Hybrid POS Terminals, as determined based on the Merchant’s Merchant's transactions processed during the previous twelve (12) months through the Global Clearing Management System (GCMS) and/or Single Message System. Transactions that were not processed by Mastercard may be included in the annual acquired Transaction count if the data is readily available to Mastercard; b. The Merchant has implemented a P2PE solution listed on the PCI SSC website; c. The Merchant has implemented an MPOS EMV acceptance solution, such as SPoC, CPoC, or MPoC, listed on the PCI SSC website; OR c. d. At least 75 percent of the Merchant’s Merchant's annual total acquired Mastercard and Maestro Transaction count is processed using Mastercard Tokens from TSPs compliant with the Token Service Provider Standards. As a best practice, qualifying Merchants participating in the Exemption Program are recommended to validate compliance with the PCI DSS within the previous twelve (12) months of entering the Exemption Program. An Acquirer must retain all Merchant certifications of eligibility for the Exemption Program for a minimum of five (5) years. Upon request by Mastercard, the Acquirer must provide a Merchant’s Merchant's certification of eligibility for the Exemption Program and any documentation and/or other information applicable to such certification. An Acquirer is responsible for ensuring that each Exemption Program certification is truthful and accurate. A Merchant that does not satisfy the Exemption Program’s Program's eligibility criteria, including any Merchant whose Transaction volume is primarily from e-commerce that does not utilize EMV Payment Tokenization and Mail Order/Telephone Order (MO/TO) acceptance channels, must continue to validate its PCI DSS compliance in accordance with section Section 2.2.2. All Merchants must maintain ongoing compliance with the PCI DSS regardless of whether annual compliance validation is a requirement. Cybersecurity Standards and Programs Mastercard PCI DSS Compliance Validation Exemption Program Security Rules and Procedures—Merchant Edition • 6 August 2024