PINs must be generated using cryptographically secure algorithms under strict control to prevent predictability, interception, or manipulation during creation, transit, and validation processes.

Processing environments must isolate and protect PIN data from unauthorized access using layered controls, cryptographic boundaries, and hardened devices validated to industry standards.

Only approved cryptographic modules and key management practices must be used to process PINs, ensuring integrity and confidentiality throughout their lifecycle, from issuance to verification.

Core Requirements of the Standard | PCI PIN Requirements

Protecting Keys Always

Control Key Access

Only authorized personnel with need-to-know clearance should access cryptographic key components.

Use Dual Custody

Keys must be handled under dual control to prevent unauthorized single-person access.

Rotate Keys Periodically

Key rotation schedules must be enforced to reduce long-term exposure and cryptographic risk.

Store Keys Securely

All keys must be stored in PCI-approved HSMs or tamper-proof physical security modules.

Safeguarding PIN Generation and Processing

PINs must be generated using cryptographically secure algorithms under strict control to prevent predictability, interception, or manipulation during creation, transit, and validation processes.
Processing environments must isolate and protect PIN data from unauthorized access using layered controls, cryptographic boundaries, and hardened devices validated to industry standards.
Only approved cryptographic modules and key management practices must be used to process PINs, ensuring integrity and confidentiality throughout their lifecycle, from issuance to verification.

Core Requirements of the Standard

Speak to a GRC expert

Share on social media