The PCI Security Standards Council, an independent industry standards body providing management of the Payment Card Industry Data Security Standard on a global basis, has assumed responsibility for the PIN Entry Device (PED) Security Requirements that were previously administered under JCB, MasterCard International and Visa International.
The PED Security Requirements are designed to secure personal identification number (PIN)-based transactions globally and apply to devices that accept PIN entry for all PIN based transactions. PED Security Requirements are divided into the following categories:
Device Characteristics
- Physical Security Characteristics
- Logical Security Characteristics
Device Management
- Device Management During Manufacturing
- Device Management Between Manufacturing and Initial Key Loading
Device characteristics are those attributes of the PED that define its physical and its logical characteristics. The physical security characteristics of the device are those attributes that deter a physical attack on the device. Logical security characteristics include those functional capabilities that preclude, for example, allowing the device to output a cleartext PIN encryption key.
Device management relates to how the PED is produced, controlled, transported, stored and used throughout its life cycle. If the device is not properly managed, unauthorized modifications might be made to its physical or logical security characteristics.
To gain approval by PCI Security Standards Council, PIN entry devices must comply with the requirements and guidelines specified in the following documents. Vendors preferring to complete forms electronically should download the appropriate documents.
