Certification Levels Explained
Card Production Security
Speak to a GRC expert
If you have any questions or need assistance, please don't hesitate to contact us.
Share on social media
Understanding PCI CPP Certification Modules
Each module isn’t just a checkbox—it defines the exact scope of your security obligations across card production stages.
Module A: Manufacturing
Covers chip and card fabrication—where security starts at the source.
Module B: Embedding
Secures chip insertion, personalization prep, and optical quality validation.
Module C: Personalization
Includes data encoding, printing, key injection, and identity linking.
Module D: Fulfillment
Focuses on secure packaging, warehousing, transport, and delivery traceability.
Full vs Partial Certification
Full Certification
Covers end-to-end production—from raw card input to final delivery.
Partial Certification
Applies to limited functions—like personalization or mailing only.
Scope Transparency
Clients and issuers must understand exactly what your certification includes.
Compliance Expectations
Even partial scope facilities must meet all applicable module requirements.
Certification by Service Scope
The services you offer dictate the standards you face—there’s no one-size-fits-all in secure card production.
Card Manufacturers Only
Require Module A—covers raw material fabrication, chip production, and security controls.
Embedding Providers Exclusively
Must certify for Module B, focused on chip placement and secure optical inspection.
Personalization Service Providers
Need Module C to validate encoding, printing, key injection, and final card configuration.
Fulfillment-Only Vendors
Are scoped under Module D for packaging, secure warehousing, and traceable distribution.
Multi-Service Facilities
Must combine all applicable modules—each service layer brings its own requirements.
Subcontracted Processors
Still fall under compliance—certification scope extends to outsourced components or functions.
Assessments That Matter
Annual assessments aren’t just dates on a calendar—they’re checkpoints of trust, continuity, and operational readiness.
Annual Certification Review
Every facility undergoes yearly audits by PCI-approved assessors with zero wiggle room.
Module-Specific Scoping
Only the services you offer are evaluated—nothing more, nothing less.
Physical Site Inspection
Assessors must visit facilities in-person to verify controls and infrastructure firsthand.
Logical Access Validation
Digital access rights, logging, and authentication protocols are tested under stress.
Key Management Controls
Cryptographic handling is reviewed for generation, storage, usage, and destruction procedures.
Personnel Role Checks
Staff vetting, training records, and dual-control procedures are verified against policy.
Continue Reading
Ready to learn more about Sample Facility Diagram?