PCI PIN Assessments

Who comes to us for this

Companies whose acquirer or scheme asks for a PCI PIN Attestation of Compliance: processors and switches that translate PINs, key-injection facilities, operators of ATM and terminal estates and the companies that deploy devices for them, certification and registration authorities that put keys into devices, and payment providers who have just taken PIN processing in house. The standard is narrower than PCI DSS and far more physical: keys, the hardware they live in, and the ceremonies between them. The people who assess it for you have built and run that hardware.

What we do

1. Scope on the key hierarchy, not the network.

   We start from the keys: every key in the hierarchy, where it is generated, how it gets into each device, where a PIN is translated, and who holds the components. From that follow the secure cryptographic devices in scope, the facilities, and the third parties with their responsibilities written down. Scope here is a diagram of keys and devices, and we draw it with you before anything is assessed.

2. Documents, then practice.

   Key-management procedures, custodian forms, ceremony logs, device inventories, HSM configurations: we read them, then we watch. A key ceremony observed, a custodian asked to produce a component, a tamper log read with the person who keeps it. The standard asks whether the control is in use, and that cannot be read from a policy.

3. On site, where the keys are.

   Key-injection rooms, HSM cages, secure storage, the dock where devices arrive: the physical controls are a large part of this standard and they are assessed in person. Remote evidence covers what it can. Nobody signs a PIN report on photographs alone.

4. Findings as they are confirmed.

   You hear about a finding when your assessor confirms it, with exactly what would close it. On PIN work that often means a procedure to rewrite and a ceremony to run again, so we tell you early, while the people and the room are still available. Remediation rounds are agreed, with a cut-off.

5. Quality review, then signature.

   Before issuing, the report goes through our pre-issue review, which can and does change determinations. Then the Qualified PIN Assessor who scoped the engagement signs the Report on Compliance and the Attestation of Compliance, and if you want your services on the Council’s list of PIN service providers, the submission that goes with it.

What we will not do