PCI Point of Interaction (POI) was introduced to minimize the risk profile present in card transactions. PCI POI Security Requirements cover physical and logical security device requirements for both online and offline PIN entry devices (PED) and secure card readers, as well as device management requirements for activity prior to the initial key loading. PCI POI applies to manufacturers that sell PIN pads, terminals with built-in PIN pads, and secure card readers.
While the PCI standard on PIN security, “PCI PIN Transaction Security Point of Interaction,” sets the rules for securely processing the PIN within the physical boundaries of the terminal, software-based SPoC implementations also bring systems outside the device into scope, giving rise to the following standards:
- “attestation” - obtaining a declaration regarding the security of the systems
- “detection” - establishing monitoring mechanisms to detect anomalies in the systems
- “response” - preparing action plans to remediate detected issues
The related document can be accessed via the link below.
