Global (PCI Security Standards Council; acquirers and their agents processing PINs, key-injection facilities and certification authorities)

PCI PIN Security

399 controls. 196 other frameworks in our corpus share controls with it. Here is all of it, and how much of it you are already doing.

Page built . This page is derived from the framework corpus, which changes when the corpus is extended rather than daily.

399 controls 196 frameworks share controls with it Global (PCI Security Standards Council; acquirers and their agents processing PINs, key-injection facilities and certification authorities) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

PCI PIN Security Evidence & Implementation Kit

399 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you runShared controls
FFIEC IT Examination Handbook17measure it →
PCI P2PE17measure it →
PCI SSF17measure it →
PSD2 SCA17measure it →
Singapore Government Instruction Manual on ICT&SS Management (IM8)15measure it →
NIST Cybersecurity Framework 2.013measure it →
South Korea ISMS-P12measure it →
ASD Strategies to Mitigate Cyber Security Incidents12measure it →
FFIEC Cybersecurity Assessment Tool (CAT)12measure it →
SOC for Cybersecurity12measure it →
SSAE 1811measure it →
Annex 11 to EU GMP10measure it →

Every control

CodeControlAlso in
CO-1PINs Used for Cardholder Authentication Are Processed in Approved Devices0
CO-10Equipment Used to Process PINs and Keys Is Managed in a Secure Manner0
CO-11Secret and Private Keys and Key Components Are Generated, Conveyed, and Used in a Manner That Prevents or Detects Their Unauthorized Disclosure, Modification, or Substitution0
CO-12Keys Are Used in a Manner That Prevents or Detects Their Unauthorized Usage0
CO-13Keys Are Administered Throughout Their Lifecycle in a Secure Manner0
CO-14Materials Used to Generate or Transport Keys Are Treated With the Same Security as the Keys They Protect0
CO-15Cryptographic Keys Are Replaced With New Keys When Knowledge of Or Access to a Key Is No Longer Required0
CO-16Keys No Longer Used or Replaced Are Securely Destroyed0
CO-17Access to Secret and Private Cryptographic Keys and Key Material Is Restricted0
CO-18Logging Is in Place to Enable Audit and Investigation of Key Management Activities0
CO-19Organizations Implement and Document Risk-Mitigation Practices0
CO-2Devices Approved Under PCI PTS POI Have SRED Functionality0
CO-3POIs and HSMs Are Protected From Unauthorized Access0
CO-4Procedures Exist to Protect Devices From Tampering and Substitution0
CO-5Cryptographic Keys Are Generated Using Approved Methods0
CO-6Cryptographic Keys Are Conveyed or Transmitted Securely0
CO-7Key Loading Is Handled in a Secure Manner0
CO-8Keys Are Used Only for Their Designated Purpose0
CO-9Keys Are Administered in a Secure Manner0
CO-Annex-ASymmetric Key Distribution Using Asymmetric Techniques0
CO-Annex-BKey-Injection Facility Requirements0
PCI-PIN-04Security policy framework0
PCI-PIN-05Roles and responsibilities definition110
PCI-PIN-06Network security and segmentation31
PCI-PIN-07Endpoint protection and detection10
PCI-PIN-08Application security controls26
PCI-PIN-09Encryption and key management62
PCI-PIN-10Secure configuration standards32
PCI-PIN-11Business continuity planning and testing21
PCI-PIN-12Disaster recovery procedures50
PCI-PIN-13Third-party dependency management32
PCI-PIN-14Critical service identification32
PCI-PIN-15Communication and escalation procedures45
PCI-PIN-16Due diligence and onboarding56
PCI-PIN-17Contractual security requirements0
PCI-PIN-18Ongoing monitoring and assessment55
PCI-PIN-19Concentration risk management55
PCI-PIN-20Exit strategy and transition planning0
PCI-PIN-21Incident detection and classification0
PCI-PIN-22Incident response and containment0
PCI-PIN-23Regulatory reporting requirements72
PCI-PIN-24Customer notification procedures72
PCI-PIN-25Post-incident review and improvement72
1-1PCI PIN 1-10
1-2PCI PIN 1-20
1-3PCI PIN 1-30
1-4PCI PIN 1-40
10-1PCI PIN 10-10
11-1PCI PIN 11-10
11-2PCI PIN 11-20
12-1PCI PIN 12-10
12-2PCI PIN 12-20
12-3PCI PIN 12-30
12-4PCI PIN 12-40
12-5PCI PIN 12-50
12-6PCI PIN 12-60
12-7PCI PIN 12-70
12-8PCI PIN 12-80
13-1PCI PIN 13-10
13-2PCI PIN 13-20
13-3PCI PIN 13-30
13-4PCI PIN 13-40
13-4.1PCI PIN 13-4.10
13-4.2PCI PIN 13-4.20
13-4.3PCI PIN 13-4.30
13-4.4PCI PIN 13-4.40
13-5PCI PIN 13-50
13-6PCI PIN 13-60
13-7PCI PIN 13-70
13-8PCI PIN 13-80
14-1PCI PIN 14-10
14-2PCI PIN 14-20
14-3PCI PIN 14-30
14-4PCI PIN 14-40
14-5PCI PIN 14-50
15-1PCI PIN 15-10
15-2PCI PIN 15-20
16-1PCI PIN 16-10
16-2PCI PIN 16-20
17-1PCI PIN 17-10
18-1PCI PIN 18-10
18-2PCI PIN 18-20
18-3PCI PIN 18-30
19-1PCI PIN 19-10
19-2PCI PIN 19-20
19-3PCI PIN 19-30
19-4PCI PIN 19-40
19-5PCI PIN 19-50
2-1PCI PIN 2-10
2-2PCI PIN 2-20
2-3PCI PIN 2-30
2-4PCI PIN 2-40
20-1PCI PIN 20-10
20-2PCI PIN 20-20
20-3PCI PIN 20-30
20-4PCI PIN 20-40
21-1PCI PIN 21-10
21-2PCI PIN 21-20
21-2.1PCI PIN 21-2.10
21-2.2PCI PIN 21-2.20
21-2.3PCI PIN 21-2.30
21-2.4PCI PIN 21-2.40
21-3PCI PIN 21-30
21-3.1PCI PIN 21-3.10
21-3.2PCI PIN 21-3.20
21-3.3PCI PIN 21-3.30
22-1PCI PIN 22-10
22-1.1PCI PIN 22-1.10
22-1.2PCI PIN 22-1.20
22-1.3PCI PIN 22-1.30
22-1.4PCI PIN 22-1.40
22-1.5PCI PIN 22-1.50
22-2PCI PIN 22-20
23-1PCI PIN 23-10
23-2PCI PIN 23-20
23-3PCI PIN 23-30
24-1PCI PIN 24-10
24-2PCI PIN 24-20
24-2.1PCI PIN 24-2.10
24-2.2PCI PIN 24-2.20
24-2.3PCI PIN 24-2.30
25-1PCI PIN 25-10
25-1.1PCI PIN 25-1.10
25-1.2PCI PIN 25-1.20
25-1.3PCI PIN 25-1.30
25-1.4PCI PIN 25-1.40
26-1PCI PIN 26-10
27-1PCI PIN 27-10
27-2PCI PIN 27-20
28-1PCI PIN 28-10
29-1PCI PIN 29-10
29-1.1PCI PIN 29-1.10
29-1.2PCI PIN 29-1.20
29-2PCI PIN 29-20
29-3PCI PIN 29-30
29-4PCI PIN 29-40
29-4.1PCI PIN 29-4.10
29-4.2PCI PIN 29-4.20
29-4.3PCI PIN 29-4.30
29-4.4PCI PIN 29-4.40
29-5PCI PIN 29-50
3-1PCI PIN 3-10
3-2PCI PIN 3-20
3-3PCI PIN 3-30
30-1PCI PIN 30-10
30-2PCI PIN 30-20
31-1PCI PIN 31-10
31-1.1PCI PIN 31-1.10
31-1.2PCI PIN 31-1.20
31-1.3PCI PIN 31-1.30
31-1.4PCI PIN 31-1.40
31-1.5PCI PIN 31-1.50
31-1.6PCI PIN 31-1.60
32-1PCI PIN 32-10
32-1.1PCI PIN 32-1.10
32-1.2PCI PIN 32-1.20
32-1.3PCI PIN 32-1.30
32-1.4PCI PIN 32-1.40
32-1.5PCI PIN 32-1.50
33-1PCI PIN 33-10
4-1PCI PIN 4-10
5-1PCI PIN 5-10
6-1PCI PIN 6-10
6-1.1PCI PIN 6-1.10
6-1.2PCI PIN 6-1.20
6-1.3PCI PIN 6-1.30
6-1.4PCI PIN 6-1.40
6-1.5PCI PIN 6-1.50
6-2PCI PIN 6-20
6-3PCI PIN 6-30
6-3.1PCI PIN 6-3.10
6-3.2PCI PIN 6-3.20
6-3.3PCI PIN 6-3.30
6-3.4PCI PIN 6-3.40
6-3.5PCI PIN 6-3.50
6-3.6PCI PIN 6-3.60
6-3.7PCI PIN 6-3.70
6-3.8PCI PIN 6-3.80
6-3.9PCI PIN 6-3.90
6-4PCI PIN 6-40
6-5PCI PIN 6-50
6-6PCI PIN 6-60
7-1PCI PIN 7-10
7-2PCI PIN 7-20
8-1PCI PIN 8-10
8-2PCI PIN 8-20
8-3PCI PIN 8-30
8-4PCI PIN 8-40
9-1PCI PIN 9-10
9-2PCI PIN 9-20
9-3PCI PIN 9-30
9-4PCI PIN 9-40
9-5PCI PIN 9-50
9-6PCI PIN 9-60
A1-ANNEXNormative Annex A1: Remote key distribution using asymmetric techniques operations0
A1-R10Annex A1 Requirement 100
A1-R15Annex A1 Requirement 150
A1-R18Annex A1 Requirement 180
A1-R19Annex A1 Requirement 190
A1-R21Annex A1 Requirement 210
A1:15-3PCI PIN A1:15-30
A1:15-4PCI PIN A1:15-40
A1:15-5PCI PIN A1:15-50
A1:18-4PCI PIN A1:18-40
A1:18-5PCI PIN A1:18-50
A1:19-6PCI PIN A1:19-60
A1:19-7PCI PIN A1:19-70
A1:19-8PCI PIN A1:19-80
A1:21-4PCI PIN A1:21-40
A2-ANNEXNormative Annex A2: Certification and registration authority operations0
A2-R1Annex A2 Requirement 10
A2-R15Annex A2 Requirement 150
A2-R19Annex A2 Requirement 190
A2-R21Annex A2 Requirement 210
A2-R22Annex A2 Requirement 220
A2-R25Annex A2 Requirement 250
A2-R28Annex A2 Requirement 280
A2-R32Annex A2 Requirement 320
A2:15-5PCI PIN A2:15-50
A2:19-10PCI PIN A2:19-100
A2:19-11PCI PIN A2:19-110
A2:19-12PCI PIN A2:19-120
A2:19-5PCI PIN A2:19-50
A2:19-6PCI PIN A2:19-60
A2:19-9PCI PIN A2:19-90
A2:19-9.1PCI PIN A2:19-9.10
A2:19-9.2PCI PIN A2:19-9.20
A2:21-4PCI PIN A2:21-40
A2:22-3PCI PIN A2:22-30
A2:22-4PCI PIN A2:22-40
A2:22-4.1PCI PIN A2:22-4.10
A2:22-4.2PCI PIN A2:22-4.20
A2:22-4.3PCI PIN A2:22-4.30
A2:22-4.4PCI PIN A2:22-4.40
A2:22-5PCI PIN A2:22-50
A2:25-2PCI PIN A2:25-20
A2:25-2.1PCI PIN A2:25-2.10
A2:25-3PCI PIN A2:25-30
A2:25-3.1PCI PIN A2:25-3.10
A2:25-3.2PCI PIN A2:25-3.20
A2:25-3.3PCI PIN A2:25-3.30
A2:25-3.4PCI PIN A2:25-3.40
A2:25-3.5PCI PIN A2:25-3.50
A2:25-4PCI PIN A2:25-40
A2:25-5PCI PIN A2:25-50
A2:25-5.1PCI PIN A2:25-5.10
A2:25-5.2PCI PIN A2:25-5.20
A2:25-6PCI PIN A2:25-60
A2:25-6.1PCI PIN A2:25-6.10
A2:25-6.2PCI PIN A2:25-6.20
A2:25-6.3PCI PIN A2:25-6.30
A2:25-7PCI PIN A2:25-70
A2:25-7.1PCI PIN A2:25-7.10
A2:25-7.2PCI PIN A2:25-7.20
A2:25-8PCI PIN A2:25-80
A2:25-8.1PCI PIN A2:25-8.10
A2:25-8.2PCI PIN A2:25-8.20
A2:25-8.3PCI PIN A2:25-8.30
A2:25-8.4PCI PIN A2:25-8.40
A2:25-8.5PCI PIN A2:25-8.50
A2:25-8.6PCI PIN A2:25-8.60
A2:25-8.7PCI PIN A2:25-8.70
A2:25-8.8PCI PIN A2:25-8.80
A2:25-8.9PCI PIN A2:25-8.90
A2:25-9PCI PIN A2:25-90
A2:28-2PCI PIN A2:28-20
A2:28-3PCI PIN A2:28-30
A2:28-4PCI PIN A2:28-40
A2:28-5PCI PIN A2:28-50
A2:28-5.1PCI PIN A2:28-5.10
A2:28-5.2PCI PIN A2:28-5.20
A2:32-2.1PCI PIN A2:32-2.10
A2:32-2.2PCI PIN A2:32-2.20
A2:32-2.3PCI PIN A2:32-2.30
A2:32-2.4PCI PIN A2:32-2.40
A2:32-2.5PCI PIN A2:32-2.50
A2:32-2.6PCI PIN A2:32-2.60
A2:32-2.7PCI PIN A2:32-2.70
A2:32-2.8PCI PIN A2:32-2.80
A2:32-2.9PCI PIN A2:32-2.90
A2:32-3PCI PIN A2:32-30
A2:32-3.1PCI PIN A2:32-3.10
A2:32-3.2PCI PIN A2:32-3.20
A2:32-3.3PCI PIN A2:32-3.30
A2:32-3.4PCI PIN A2:32-3.40
A2:32-4PCI PIN A2:32-40
A2:32-4.1PCI PIN A2:32-4.10
A2:32-4.2PCI PIN A2:32-4.20
A2:32-5PCI PIN A2:32-50
A2:32-6PCI PIN A2:32-60
A2:32-6.1PCI PIN A2:32-6.10
A2:32-6.2PCI PIN A2:32-6.20
A2:32-6.3PCI PIN A2:32-6.30
A2:32-7PCI PIN A2:32-70
A2:32-7.1PCI PIN A2:32-7.10
ANNEXESNormative Annexes A, B and C: what each applies to, and how their numbering continues the main body0
B-ANNEXNormative Annex B: Key-injection facilities0
B-R12Annex B Requirement 120
B-R13Annex B Requirement 130
B-R14Annex B Requirement 140
B-R18Annex B Requirement 180
B-R20Annex B Requirement 200
B-R25Annex B Requirement 250
B-R26Annex B Requirement 260
B-R27Annex B Requirement 270
B-R29Annex B Requirement 290
B-R30Annex B Requirement 300
B-R32Annex B Requirement 320
B-R33Annex B Requirement 330
B-R7Annex B Requirement 70
B-R8Annex B Requirement 80
B:12-1PCI PIN B:12-10
B:12-9PCI PIN B:12-90
B:13-2PCI PIN B:13-20
B:13-9PCI PIN B:13-90
B:13-9.1PCI PIN B:13-9.10
B:13-9.2PCI PIN B:13-9.20
B:13-9.3PCI PIN B:13-9.30
B:13-9.4PCI PIN B:13-9.40
B:14-1PCI PIN B:14-10
B:18-2PCI PIN B:18-20
B:18-6PCI PIN B:18-60
B:18-7PCI PIN B:18-70
B:20-4PCI PIN B:20-40
B:20-5PCI PIN B:20-50
B:20-6PCI PIN B:20-60
B:25-1.4PCI PIN B:25-1.40
B:26-1PCI PIN B:26-10
B:27-2PCI PIN B:27-20
B:29-3PCI PIN B:29-30
B:30-3PCI PIN B:30-30
B:32-1.5PCI PIN B:32-1.50
B:32-8PCI PIN B:32-80
B:32-8.1PCI PIN B:32-8.10
B:32-8.2PCI PIN B:32-8.20
B:32-8.3PCI PIN B:32-8.30
B:32-8.4PCI PIN B:32-8.40
B:32-8.5PCI PIN B:32-8.50
B:32-8.6PCI PIN B:32-8.60
B:32-8.7PCI PIN B:32-8.70
B:32-9PCI PIN B:32-90
B:32-9.1PCI PIN B:32-9.10
B:32-9.10PCI PIN B:32-9.100
B:32-9.11PCI PIN B:32-9.110
B:32-9.12PCI PIN B:32-9.120
B:32-9.2PCI PIN B:32-9.20
B:32-9.3PCI PIN B:32-9.30
B:32-9.4PCI PIN B:32-9.40
B:32-9.5PCI PIN B:32-9.50
B:32-9.6PCI PIN B:32-9.60
B:32-9.7PCI PIN B:32-9.70
B:32-9.8PCI PIN B:32-9.80
B:32-9.9PCI PIN B:32-9.90
B:33-1PCI PIN B:33-10
B:7-1PCI PIN B:7-10
B:8-1PCI PIN B:8-10
CO1Control Objective 1: PINs used in transactions governed by these requirements are processed using equipment and methodologies that ensure they are kept secure0
CO2Control Objective 2: Cryptographic keys used for PIN encryption and decryption and related key management are created using processes that ensure it is not possible to predict any 0
CO3Control Objective 3: Keys are conveyed or transmitted in a secure manner0
CO4Control Objective 4: Key loading to HSMs and POI PIN-acceptance devices is handled in a secure manner0
CO5Control Objective 5: Keys are used in a manner that prevents or detects their unauthorized usage0
CO6Control Objective 6: Keys are administered in a secure manner0
CO7Control Objective 7: Equipment used to process PINs and keys is managed in a secure manner0
DATESThe phased effective dates the standard carries, and the Council's revisions to them0
R1Requirement 10
R10Requirement 100
R11Requirement 110
R12Requirement 120
R13Requirement 130
R14Requirement 140
R15Requirement 150
R16Requirement 160
R17Requirement 170
R18Requirement 180
R19Requirement 190
R2Requirement 20
R20Requirement 200
R21Requirement 210
R22Requirement 220
R23Requirement 230
R24Requirement 240
R25Requirement 250
R26Requirement 260
R27Requirement 270
R28Requirement 280
R29Requirement 290
R3Requirement 30
R30Requirement 300
R31Requirement 310
R32Requirement 320
R33Requirement 330
R4Requirement 40
R5Requirement 50
R6Requirement 60
R7Requirement 70
R8Requirement 80
R9Requirement 90
REGIMEHow compliance is assessed: the PIN security programme, QPAs, the ROC and AOC, and the payment brands' programmes0
STANDARDPCI PIN Security Requirements v3.1: what it is, its versions, and what is held0

Tell me when PCI PIN Security files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

  • TPSP register
  • AOC collection log
  • contractual responsibility matrix
  • monitoring cadence
  • vendor monitoring schedule
  • annual review reports
  • security charter
  • board reporting pack
  • risk register
  • policy library

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

What this page is

A control-level reference for PCI PIN Security, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition