Latest press release from the PCI Security Standards Council – June 28, 2012:
The PCI Security Standards Council (PCI SSC), a global, open industry standards body providing management of the Payment Card Industry Data Security Standard (PCI DSS), PIN Transaction Security (PTS) requirements and the Payment Application Data Security Standard (PA-DSS), today announced availability of the Point-to-Point Encryption (P2PE) Program Guide and Self-Assessment Questionnaire (SAQ) to support implementation of hardware-based point-to-point encryption (P2PE) solutions.
The resources follow the Council’s release of updated Solution Requirements and Testing Procedures for hardware-based P2PE solutions in April, which provide a method for vendors to validate their P2PE solutions and for merchants to reduce the scope of their PCI DSS assessments by using a validated P2PE solution for accepting and processing payment card data.
Eligible merchants using these P2PE hardware solutions may be able to reduce the scope of their PCI DSS assessments and validate to a reduced set of PCI DSS requirements. To help with this validation process, the Council has developed a new Self-Assessment Questionnaire (SAQ P2PE-HW).
SAQ P2PE-HW is for merchants who process cardholder data via hardware terminals included in a validated P2PE solution and consists of the following components:
- Merchant eligibility criteria
- SAQ completion steps
- Self-Assessment Questionnaire (validation of PCI DSS Requirements)
- Attestation of Compliance, including Attestation of PIM Implementation
Merchants should refer to their acquirer and/or payment brand to determine if they are eligible to use this new SAQ.
The Council has also updated the PCI DSS SAQ Instructions and Guidelines document to provide additional guidance on use of the SAQ P2PE-HW.
The PCI P2PE Program Guide is designed to help solution providers, application vendors, and P2PE assessors understand how to complete a P2PE assessment and submit it to the Council for acceptance and listing on the PCI SSC website. The document includes:
- Overview of P2PE solution validation processes
- Considerations for P2PE Solution providers preparing for assessment
- Reporting considerations for P2PE assessors
- Considerations for managing validated P2PE Solutions
- Listing of applications used in P2PE solutions
Solution providers, application vendors, and P2PE assessors can use this document immediately to plan for their P2PE assessments.
In the coming weeks, the Council will provide templates and Reporting Instructions for P2PE validation reports, as well as new Attestations of Validation (AOVs) and vendor release agreement (VRA). P2PE assessors, solution providers and application vendors can then complete their assessments of P2PE Solutions and applications and submit their reports and validation documentation to the Council for acceptance and listing. The Council will list the validated solutions on the PCI SSC website for merchants to use.
“These resources are a critical part of rolling out this program,” said Bob Russo, general manager, PCI Security Standards Council. “The program guide outlines the submission and listing process for P2PE solution providers and application vendors who want to validate their products, while the SAQ will help simplify PCI DSS validation efforts for merchants taking advantage of this process to minimize the amount of cardholder data in their environments.”
Nancy Sykora
Sr. Account Executive