PCI SSC takes on Pin Entry Device security

The Payment Card Industry Security Standards Council (PCI SSC) has assumed responsibility for the Pin Entry Device (Ped) security requirements previously administered by JCB, MasterCard and Visa.

PCI SSC is a global independent industry standards body providing management of the PCI Data Security Standard relating to all card-based payments.

The Ped security requirements are designed to secure Pin-based transactions globally, and apply to all devices that accept Pin entry.

"Adding the Ped security requirements reinforces and expands our commitment to securing the payment process globally," said Bob Russo, general manager of the PCI SSC.

"The addition of the Ped Security Requirements under the PCI SSC will remove conflicting requirements, simplify the testing process and maintain consistent security measures to improve the overall security of payment transactions."

Ped manufacturers submitting devices for security testing will be able to rely on a single set of requirements, helping to ensure cardholder security and providing opportunities for faster development and deployment.

The Ped security requirements look at all aspects of Ped development, including physical and its logical characteristics, as well as how the Ped is produced, controlled, transported, stored and used throughout its life cycle.

The transfer of power will happen over the next few months. During this time, all devices previously approved and designated as compliant with existing PCI Ped requirements will automatically be accepted into the new programme.

The PCI SSC has said it will honour existing compliance agreements, with these devices listed on the PCI SSC approval list until their current existing approvals expire.