Transaction Processing Operations

PCI PIN requirements are organized in Control Objectives. Each Control Objective groups requirements for securing an aspect of security for PINs.

Topics

• Control Objective 1: PINs used in transactions governed by these requirements are processed using equipment and methodologies that ensure they are kept secure.

• Control Objective 2: Cryptographic keys used for PIN encryption/decryption and related key management are created using processes that ensure that it is not possible to predict any key or determine that certain keys are more probable than other keys.

• Control Objective 3: Keys are conveyed or transmitted in a secure manner.

• Control Objective 4: Key-loading to HSMs and POI PIN-acceptance devices is handled in a secure manner.

• Control Objective 5: Keys are used in a manner that prevents or detects their unauthorized usage.

• Control Objective 6: Keys are administered in a secure manner.

• Control Objective 7: Equipment used to process PINs and keys is managed in a secure manner.