PCI P2PE

Applications loaded onto P2PE-approved POI devices must not interfere with the device's SRED protections and must follow secure development practices documented by the solution provider.

• List of all applications loaded on POI devices including version numbers
• Secure SDLC documentation for POI applications
• Evidence that applications were tested and approved by the solution provider
• Application change control records

• Unauthorized applications side-loaded onto field devices
• No version control linking deployed application to tested baseline
• Third-party application updates installed without P2PE re-validation

P2PE solutions must undergo annual reassessment by a P2PE QSA and any significant change to the solution must trigger reassessment of affected domains and updates to the listing on the PCI SSC website.

• Annual P2PE Report on Validation (P-ROV) and Attestation of Validation (AOV)
• Change log identifying significant changes triggering reassessment
• Evidence of timely listing updates on the PCI SSC website
• Internal change-impact analysis records

• Significant changes implemented without notifying the P2PE QSA
• Listing showing outdated solution versions
• Change-impact analysis not retained for QSA review

The decryption environment where account data is converted from ciphertext to plaintext must be logically isolated, hardened, and protected by strong access controls compliant with PCI DSS.

• Decryption environment network diagram with isolation evidence
• Hardening baselines applied to decryption servers and HSMs
• PCI DSS Attestation of Compliance covering the decryption environment
• Access logs for personnel entering the decryption environment

• Decryption environment shared with broader CDE without segmentation testing
• HSM management interfaces accessible from corporate networks
• Insufficient logging of HSM operator commands

Solution providers must give merchants clear instructions for deploying, operating, and inspecting POI devices, captured in the P2PE Instruction Manual (PIM), and verify merchant adherence where applicable.

• Current PIM provided to merchants for each solution version
• Merchant acknowledgment of PIM receipt
• Photos and serial-number guidance to identify legitimate devices
• Inspection checklist provided to merchants

• Outdated PIM not refreshed when solution changes
• No record that merchants acknowledged the PIM
• Inspection guidance missing for newer device models

All Point-of-Interaction (POI) devices used in a P2PE solution must be PCI PTS approved with SRED enabled, and must remain in approved status throughout the solution lifecycle.

• PCI PTS approval listings for each POI model with SRED listed as approved
• Device firmware version inventory mapped to approved configurations
• Process for re-evaluating devices that exit the PTS list
• Vendor documentation confirming SRED enablement

• POI firmware versions deployed are not those evaluated under PTS
• Devices remain in service past PTS expiry without remediation plan
• SRED feature not enabled at provisioning

POI devices must authenticate to the decryption environment or processor using strong cryptographic mechanisms to prevent rogue device connections from injecting fraudulent transactions.

• Authentication design documentation (mutual TLS, signed messages)
• Certificate or key inventory mapping each device identity
• Monitoring alerts for unrecognized device identifiers
• Process to deactivate identities for lost or stolen devices

• Shared device authentication credentials across multiple terminals
• No automatic deactivation of devices reported lost
• Lack of monitoring for unexpected device identifiers

Solution providers must manage POI devices throughout their entire lifecycle including secure shipping, deployment, operation, maintenance, and decommissioning to ensure device integrity is maintained.

• Device inventory with serial numbers, deployment locations, and status
• Secure shipping procedures with tamper-evident packaging records
• Receipt verification records signed by merchants
• Decommissioning records showing key zeroization and secure disposal

• Inventory mismatched between solution provider and merchant records
• Devices shipped via untracked carriers
• Decommissioned devices stored without secure disposal evidence

Solution providers must maintain a P2PE Solution Reference Architecture and supporting documentation that accurately describes all components, data flows, and merchant responsibilities in the solution.

• Current P2PE Reference Architecture document
• Component inventory listing POI models, HSMs, and supporting systems
• Data-flow diagrams covering encryption and decryption paths
• Validation documentation submitted to the P2PE QSA

• Architecture documentation lags behind production changes
• Component inventory missing version details
• Merchant guidance not refreshed at each annual validation

Account data must be encrypted within the secure boundary of the POI device immediately upon entry, using approved cryptographic algorithms and keys that are unique per device or per transaction.

• Device cryptographic design documentation
• Evidence of per-device or per-transaction key derivation (e.g., DUKPT)
• Approved algorithm list with key lengths matching PCI requirements
• Test results confirming no clear-text PAN exits the secure boundary

• Per-terminal master keys reused across multiple devices
• Encryption performed outside the SRED boundary
• Algorithms below the minimum strength specified by NIST

Annex A defines requirements for distributing symmetric keys to POI devices using asymmetric cryptography (remote key loading), including device authentication, certificate validation, and ceremony controls.

• Remote key loading design documentation
• Certificate authority hierarchy and trust anchor management procedures
• Session logs for each remote key loading event
• Device identity validation evidence prior to key distribution

• Certificate revocation not checked at the time of key load
• Single point of failure in the trust anchor management process
• Session logs lack operator identification

Key Injection Facilities (KIFs) must operate under approved physical, logical, and procedural controls including dedicated rooms, dual-control operations, and PCI-approved Tamper-Resistant Security Modules (TRSMs).

• KIF certification documentation by an approved P2PE QSA
• Physical layout diagrams and access control records
• Operator role assignments enforcing dual control and split knowledge
• Injection logs identifying each device and operator

• KIF operating outside of certified physical boundary
• Operator role conflicts permitting single-person key operations
• Logs missing identification of dual operators per injection event

Cryptographic keys used to protect account data must be generated using methods that ensure unpredictability, sufficient strength, and proper documentation under dual control and split knowledge.

• Key generation ceremony scripts and signed witness records
• Evidence that RNG sources meet PCI requirements (FIPS 140-2/3 validated HSMs)
• Custodian acknowledgments signed at the time of ceremony
• Video recordings of ceremonies where required

• Ceremony scripts not approved in advance by key management authority
• Witnesses lack independence from custodians
• RNG source unverified or based on uncertified hardware

Symmetric and asymmetric keys must be distributed to POI devices through secure channels using approved methods such as remote key distribution, key injection at certified facilities, or transport using approved cryptograms.

• Key Injection Facility (KIF) certification documentation
• Key injection logs linking device serial numbers to injected keys
• Remote key loading session records
• Key transport mechanism design documentation

• Key injection performed at unapproved facilities
• Injection logs missing operator identification and timestamps
• Remote key loading sessions not authenticated

Cryptographic keys must be stored in PCI-approved cryptographic devices (HSMs) or under equivalent protection, with secret components never appearing in clear-text outside approved cryptographic boundaries.

• HSM inventory with approval listings (PCI HSM or FIPS 140-2/3 Level 3+)
• Procedures prohibiting clear-text key components outside HSMs or secure cryptographic devices
• Key Encrypting Key (KEK) hierarchy documentation
• Procedures for secure storage of clear-text key components when permitted

• Backup keys exported in clear-text for offline storage
• HSMs operating in non-FIPS mode without compensating analysis
• Key hierarchy undocumented or inconsistent across environments

Keys must be used only for their authorized purpose and replaced at the end of defined cryptoperiods or when compromise is suspected. Separate keys must be used for separate cryptographic functions.

• Documented cryptoperiods for each key type
• Key inventory recording purpose, creation date, and scheduled rotation
• Key compromise response procedures
• Evidence of timely key rotation

• Cryptoperiods exceeded without risk assessment
• Same key used for both data encryption and key wrapping
• Compromise response procedure untested

Cryptographic keys no longer needed must be destroyed in a manner that prevents their recovery, including zeroization of HSMs, smart cards, and any media containing key components.

• Documented key destruction procedures
• Destruction certificates signed by witnesses
• HSM zeroization logs
• Inventory updates reflecting destroyed keys

• Destruction performed without dual witnesses
• Key media destroyed without certified shredding
• Inventory not updated post-destruction leading to ghost entries

Solution providers must support merchant PCI DSS scope reduction by clearly identifying merchant responsibilities, providing the P2PE Instruction Manual (PIM), and supporting completion of the P2PE SAQ.

• Current PIM aligned with the validated solution version
• Merchant responsibilities matrix
• Process for responding to merchant questions about SAQ P2PE
• Records of PIM updates communicated to merchant base

• PIM language insufficient for merchants to complete SAQ P2PE
• Merchants unaware of new PIM versions
• Responsibility matrix not signed by both parties

Network security and segmentation. Control from PCI P2PE framework, domain: PCI P2PE: Cybersecurity Controls.

• network diagram
• encryption inventory
• key management procedure
• secure config standards

• scope creep
• weak key rotation
• default credentials
• unmanaged endpoints

Endpoint protection and detection. Control from PCI P2PE framework, domain: PCI P2PE: Cybersecurity Controls.

• network diagram
• encryption inventory
• key management procedure
• secure config standards

• scope creep
• weak key rotation
• default credentials
• unmanaged endpoints

Application security controls. Control from PCI P2PE framework, domain: PCI P2PE: Cybersecurity Controls.

• network diagram
• encryption inventory
• key management procedure
• secure config standards

• scope creep
• weak key rotation
• default credentials
• unmanaged endpoints

Encryption and key management. Control from PCI P2PE framework, domain: PCI P2PE: Cybersecurity Controls.

• network diagram
• encryption inventory
• key management procedure
• secure config standards

• scope creep
• weak key rotation
• default credentials
• unmanaged endpoints

Secure configuration standards. Control from PCI P2PE framework, domain: PCI P2PE: Cybersecurity Controls.

• network diagram
• encryption inventory
• key management procedure
• secure config standards

• scope creep
• weak key rotation
• default credentials
• unmanaged endpoints

Incident detection and classification. Control from PCI P2PE framework, domain: PCI P2PE: Incident Management & Reporting.

• incident response plan
• forensic readiness procedure
• card brand notification template
• post-incident review

• no card brand contact
• untested IR
• weak forensic preservation
• late notifications

Incident response and containment. Control from PCI P2PE framework, domain: PCI P2PE: Incident Management & Reporting.

• incident response plan
• forensic readiness procedure
• card brand notification template
• post-incident review

• no card brand contact
• untested IR
• weak forensic preservation
• late notifications

Regulatory reporting requirements. Control from PCI P2PE framework, domain: PCI P2PE: Incident Management & Reporting.

• incident response plan
• forensic readiness procedure
• card brand notification template
• post-incident review

• no card brand contact
• untested IR
• weak forensic preservation
• late notifications

Customer notification procedures. Control from PCI P2PE framework, domain: PCI P2PE: Incident Management & Reporting.

• incident response plan
• forensic readiness procedure
• card brand notification template
• post-incident review

• no card brand contact
• untested IR
• weak forensic preservation
• late notifications

Post-incident review and improvement. Control from PCI P2PE framework, domain: PCI P2PE: Incident Management & Reporting.

• incident response plan
• forensic readiness procedure
• card brand notification template
• post-incident review

• no card brand contact
• untested IR
• weak forensic preservation
• late notifications

Information security program management. Control from PCI P2PE framework, domain: PCI P2PE: Information Security Governance.

• security charter
• board reporting pack
• risk register
• policy library

• no executive sponsor
• stale policies
• undefined accountability
• missing risk appetite

Board and management oversight. Control from PCI P2PE framework, domain: PCI P2PE: Information Security Governance.

• security charter
• board reporting pack
• risk register
• policy library

• no executive sponsor
• stale policies
• undefined accountability
• missing risk appetite

Risk appetite and tolerance for IT risk. Control from PCI P2PE framework, domain: PCI P2PE: Information Security Governance.

• security charter
• board reporting pack
• risk register
• policy library

• no executive sponsor
• stale policies
• undefined accountability
• missing risk appetite

Security policy framework. Control from PCI P2PE framework, domain: PCI P2PE: Information Security Governance.

• security charter
• board reporting pack
• risk register
• policy library

• no executive sponsor
• stale policies
• undefined accountability
• missing risk appetite

Roles and responsibilities definition. Control from PCI P2PE framework, domain: PCI P2PE: Information Security Governance.

• security charter
• board reporting pack
• risk register
• policy library

• no executive sponsor
• stale policies
• undefined accountability
• missing risk appetite

Business continuity planning and testing. Control from PCI P2PE framework, domain: PCI P2PE: Operational Resilience.

• BCP plan
• DR test results
• vendor dependency map
• critical service list

• untested DR
• single vendor dependency
• no exit plan
• missing comms tree

Disaster recovery procedures. Control from PCI P2PE framework, domain: PCI P2PE: Operational Resilience.

• BCP plan
• DR test results
• vendor dependency map
• critical service list

• untested DR
• single vendor dependency
• no exit plan
• missing comms tree

Third-party dependency management. Control from PCI P2PE framework, domain: PCI P2PE: Operational Resilience.

• BCP plan
• DR test results
• vendor dependency map
• critical service list

• untested DR
• single vendor dependency
• no exit plan
• missing comms tree

Critical service identification. Control from PCI P2PE framework, domain: PCI P2PE: Operational Resilience.

• BCP plan
• DR test results
• vendor dependency map
• critical service list

• untested DR
• single vendor dependency
• no exit plan
• missing comms tree

Communication and escalation procedures. Control from PCI P2PE framework, domain: PCI P2PE: Operational Resilience.

• BCP plan
• DR test results
• vendor dependency map
• critical service list

• untested DR
• single vendor dependency
• no exit plan
• missing comms tree

Due diligence and onboarding. Control from PCI P2PE framework, domain: PCI P2PE: Third-Party Risk Management.

• TPSP register
• AOC collection log
• contractual responsibility matrix
• monitoring cadence

• missing AOCs
• weak responsibility matrix
• no ongoing monitoring
• expired attestations

Contractual security requirements. Control from PCI P2PE framework, domain: PCI P2PE: Third-Party Risk Management.

• TPSP register
• AOC collection log
• contractual responsibility matrix
• monitoring cadence

• missing AOCs
• weak responsibility matrix
• no ongoing monitoring
• expired attestations

Ongoing monitoring and assessment. Control from PCI P2PE framework, domain: PCI P2PE: Third-Party Risk Management.

• TPSP register
• AOC collection log
• contractual responsibility matrix
• monitoring cadence

• missing AOCs
• weak responsibility matrix
• no ongoing monitoring
• expired attestations

Concentration risk management. Control from PCI P2PE framework, domain: PCI P2PE: Third-Party Risk Management.

• TPSP register
• AOC collection log
• contractual responsibility matrix
• monitoring cadence

• missing AOCs
• weak responsibility matrix
• no ongoing monitoring
• expired attestations

Exit strategy and transition planning. Control from PCI P2PE framework, domain: PCI P2PE: Third-Party Risk Management.

• TPSP register
• AOC collection log
• contractual responsibility matrix
• monitoring cadence

• missing AOCs
• weak responsibility matrix
• no ongoing monitoring
• expired attestations

POI devices must protect against physical and logical tampering through SRED protections, tamper-evident enclosures, and self-destruct mechanisms that zeroize cryptographic keys upon detected tampering.

• Vendor design documentation showing tamper response circuitry
• Records of merchant or solution-provider periodic tamper inspections
• Procedures for handling tampered devices including secure return
• Evidence that detected tampering triggers automatic key zeroization

• Tamper inspection schedules undocumented for unattended kiosks
• Suspected-tampered devices returned without secure chain of custody
• Procedures missing for staff to escalate suspected tampering

Decryption environments must be physically secured with controlled access, environmental monitoring, and protection against unauthorized observation of cryptographic key management activities.

• Physical access logs for HSM rooms and key ceremony areas
• Dual-control procedures for HSM physical access
• Surveillance footage retention policy
• Visitor escort and identification records

• Single individual physical access to HSMs without dual control
• Surveillance gaps in key ceremony rooms
• Visitor access not logged with photo identification