Guide
PCI PIN security requirements, and who they really apply to
PCI PIN security requirements protect PINs and the cryptographic keys around them. So they mainly apply to acquirers, processors and key injection facilities, not to most merchants.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What PCI PIN security requirements cover
The standard covers the secure handling of PIN data during online and offline payment transactions. Also, it sets strict rules for cryptographic key management.
- Protection of PINs during processing
- Key generation, loading and storage
- Secure devices for key handling
- Physical and procedural controls
Who must meet PCI PIN security requirements
Applicability depends on your role in PIN processing. However, merchants that only accept PINs on approved terminals are usually not assessed directly.
| Entity | Usually in scope? |
|---|---|
| Acquirer or processor | Yes |
| Key injection facility | Yes |
| Merchant using approved terminals | Usually not |
PCI PIN security requirements check
Tick what describes your role.
Your result appears here as you tick, so you can see what is still open.
PCI PIN security requirements compared with PCI DSS
PCI DSS covers account data broadly. In contrast, the PIN requirements focus on PINs and keys. Therefore an entity can be in scope for both, with separate assessments.
How assessment works
Card brands set validation rules for PIN. Assessments are carried out by Qualified PIN Assessors. So evidence centres on key ceremonies, logs and device controls.
Where we help
We are not an assessor. However, we help organise procedures and documentation before assessment. Gap analysis runs $8,000 to $40,000. The requirements are in the PCI SSC document library.
Also plan key ceremonies well ahead. Because they need several named custodians in one place, scheduling often takes longer than the work itself. So book them early and record every step. In addition, keep a register of devices that hold keys, because assessors trace each key through its whole life. As a result, gaps in custody records are found before assessment, not during it.
PCI PIN security requirements questions
Do merchants need to meet PCI PIN security requirements?
Usually not, when they use approved terminals and a processor.
Who assesses PCI PIN security requirements?
A Qualified PIN Assessor, approved by PCI SSC.
Are PCI PIN security requirements part of PCI DSS?
No. They are a separate standard.
Why is key management so central?
Because a compromised key exposes every PIN it protects.
Related guides
Prepare for PCI PIN security requirements
Describe your role in PIN processing. We reply with a written estimate, usually inside one business day. Also tell us which card brands asked you to validate, because their rules set the deadline. So the estimate reflects your real timetable.
Get my written estimate