PCI PIN Security v3.1

Normative Annex B – Key-Injection Facilities 

Control Objective 7: Equipment used to process PINs and keys is managed in a secure manner 

Requirement 32: Any SCD capable of encrypting a key and producing cryptograms (i.e., an HSM or key-injection/loading device) of that key must be protected against unauthorized use to encrypt known keys or known key components. This protection takes the form of one or more of the following: 
a) Dual access controls required to enable the key-encryption function 
b) Physical protection of the equipment (e.g., locked access to it) under dual control 
c) Restriction of logical access to the equipment 
Key-injection facilities must ensure protection against unauthorized use for SCDs (e.g., HSMs) used in the key-injection platform that are capable of encrypting a key and producing cryptograms of that key. 

PIN Security Requirements:
32-1 For HSMs and other SCDs used for the generation or loading of cryptographic keys for use in POI devices, procedures must be documented and implemented to protect against unauthorized access and use. Required procedures and processes include the following:
Testing Procedures:
32-1 Examine documented procedures to confirm that they specify protection against unauthorized access and use for HSMs and other devices used for the generation or loading of cryptographic keys for use in POI devices.