Companies that have been through several PCI DSS assessments arrive at their first PCI PIN assessment expecting more of the same: a long list of requirements, a shared evidence folder, screenshots and policies. Then the assessor asks to see the key ceremony, in the room, with the custodians, and the preparation starts again from the beginning.
The PCI PIN Security Requirements are narrower than PCI DSS and far more concrete. They apply to anyone who processes PINs or manages the keys that protect them on behalf of acquirers: processors and switches, key-injection facilities, operators of terminal and ATM estates, certification and registration authorities, and the service providers that do these things for them. The standard is organised around the life of a key: how it is generated, conveyed, loaded, used, administered and destroyed, and in what hardware each of those steps happens.
Start with the key hierarchy
Everything in the assessment hangs off one diagram: every key in your hierarchy, its purpose, where it is generated, how it gets into each device that uses it, where a PIN block is translated from one key to another, and who holds the components. If you cannot draw it, you are not ready, and the first weeks of the engagement will be spent drawing it with your assessor instead of assessing.
From the diagram follows the scope: the secure cryptographic devices, which means the HSMs and the PIN entry devices and anything else that holds a clear key; the facilities where keys are generated, loaded or stored; and the third parties, each with its responsibilities written down. A key-injection facility you use, an encryption support organisation that generates keys for you, a data centre that houses your HSMs: each one either has its own attestation you can rely on or is part of yours.
What the assessor will ask to see
The documents. Key-management policy and procedures, custodian appointments and signed acknowledgements, key ceremony scripts, key and component inventories, device inventories with serial numbers and locations, HSM configuration standards, and the logs of every ceremony, every component access and every device movement. The documents have to describe what you do. Not a template; what you do.
The practice. Then the assessor watches. A key ceremony performed under dual control, with split knowledge, logged as it happens. A custodian asked to produce a component from the safe, which tests the safe, the custodian and the log in one move. An HSM’s configuration read on the console, not in a document. The tamper-evident bags, their serial numbers against the log, the seals intact. The standard asks whether a control is in use, and the only way to answer is to see it used.
The physical. Key-injection rooms and their access control, HSM cages, safes and their combinations, the dock where devices arrive and the records that show they were inspected before they were trusted. Much of this is assessed on site, in person. Remote evidence covers what it can; nobody signs a PIN report on photographs alone.
The documents have to describe what you do. Not a template; what you do.
Where it goes wrong
The failures we see are rarely cryptographic. They are human and procedural.
A key component in a drawer, kept “for backup” by someone who left the key team two years ago. Every component is in scope, including the ones nobody uses.
A ceremony script written for the audit and never run as written. The custodians know the real steps; the script describes different ones. The assessor will notice within minutes, because the custodians hesitate where the script does not.
Dual control that exists on paper. Two custodians appointed, one of whom is always travelling, so the other has learned to manage. The log shows two signatures in the same handwriting.
Device inventories that stopped being updated when the fleet was outsourced. The terminals belong to a partner now, so nobody keeps the list, and nobody can say which devices hold which keys.
HSM audit logs that nobody reads, and an HSM in a disaster-recovery site that was configured once, years ago, differently from production.
None of these are hard to fix. All of them are hard to fix in the two weeks before an assessment, because the fix is a procedure that has to be run, by people who have to be in the room, and logged.
What has changed on the Council’s side
Two things are worth knowing if your last PIN assessment is more than a couple of years old.
The Council now publishes a list of PCI PIN service providers. A validated service can be listed, with its assessor and its expiry, and acquirers and brands increasingly look there before they look at your attestation. Listing is optional and comes with its own submission steps and fees, through the Council’s portal, either by your assessor or by you; the release agreement is signed per assessment. If being on the list matters commercially, plan for it as part of the engagement rather than after.
The programme that governs the assessors has also tightened: evidence retention, independence, requalification and the quality criteria the Council applies when it audits an assessor’s work. In practice that means your assessor will ask for more primary evidence and accept fewer assertions, which is the direction the whole industry is moving.
A preparation order that works
- Draw the key hierarchy and the device map. Agree them with your assessor before anything else.
- Name the custodians, confirm they are available during the assessment window, and check the appointments and acknowledgements are signed.
- Reconcile the inventories against reality: every component, every HSM, every device, every safe. Fix the inventory, not the reality, where they differ because of a record; fix the reality where a component is where it should not be.
- Run one ceremony end to end, from the written script, with the real custodians, and log it. Correct the script where the room disagreed with it.
- Pull the HSM configurations and audit logs for production and recovery, and read them against your own standard.
- Write down each third party’s responsibilities and collect the attestations you rely on.
- Only then, fill the evidence requests. By this point most of them are already answered.