PCI PIN refers to the security requirements and assessment for merchants that accept, process or transmit payment card personal identification numbers (PIN).
Quick Answer:
What is a PCI PIN assessment and who needs one?
A PCI PIN assessment evaluates PIN encryption, key management, and secure PIN processing, required every two years for companies that handle PIN transactions or encryption management.
- It covers PIN encryption, key management, and secure processing across POS devices and HSMs.
- Required for companies acquiring, processing, storing, or transmitting PIN data.
- Also required for key injection facilities, certificate authorities, and entities named by card brands.
- Assessments happen every two years and typically start around $50,000.
- A PIN ROC can run over 200 pages, versus 18-20 for PCI DSS key management alone.
What does PCI PIN stand for?
PCI PIN refers to the security requirements and assessment for merchants that accept, process or transmit payment card personal identification numbers (PIN). The PIN Security requirements are set by the Payment Card Industry Security Standards Council (PCI SSC) and outlined in the PCI PIN Security Documents and Procedures V.3.
What is a PCI PIN Assessment?
The purpose of a PCI PIN Assessment is to assess that organizations are securely managing, processing, and transmitting PIN data during online and offline payment card transactions. A PCI PIN Assessment involves encryption and key management of PIN transactions, as well as the secure management of processing equipment. POS devices (where you enter your PIN) and the hardware security module (HSM) used to decrypt the PIN and to manage the keys are all key parts of a PIN Assessment. Your PIN is encrypted and its unique key is stored on the device. Any part of this chain–processing the PIN and managing keys used to protect the PIN–is considered in scope.
Who needs PCI PIN Assessments?
The PCI PIN Assessment is required for:
- Companies performing activities in the PIN transaction process such as
- Acquiring (including ISOs)
- Processing
- Storage
- Transmission
- Companies that provide encryption management services such as:
- Key-injection facilities (KIFs)
- Certificate and registration authorities (CAs and RAs)
In addition, other entities may fall into scope if directed by a participating payment brand to perform a PIN Assessment.
How often is a PCI PIN Assessment done?
PCI PIN Assessments are done every 2 years.
What is the process of a PCI PIN Assessment?
The PCI PIN Assessment process will depend heavily on the client’s environment. A PIN Assessment is generally more complicated than a regular PCI DSS Assessment. Analysts must assess both the operational front end and the decryption environment. This includes the payment processing equipment as well as strict and detailed key management processes. To put it in perspective, a PCI DSS Report on Compliance (ROC) usually has around 18 to 20 pages devoted to key management, while a PCI PIN Report on Compliance may have over two hundred.
The PCI PIN ROC format is fixed by the PCI Security Standards Council and should not vary depending on the security vendor.
After the report is complete, it will be sent to the card brands.
How much does a PCI PIN Assessment cost?
PCI PIN Assessments start at around $50,000, but price will depend on a few factors. These include the amount of consulting time necessary to prepare for the PIN assessment and the number of locations that need to be assessed.
Related Posts
.svg)