PIN Security Requirements:
30-1 POI devices must be secured throughout the device lifecycle. The responsible entity must:
- Maintain inventory-control and monitoring procedures to accurately track POI devices in their possession.
- Physically secure POI devices awaiting deployment or otherwise not in use.
- Implement procedures to prevent and detect the unauthorized alteration or replacement of POI devices in possession during deployment.
- Ensure that POI devices are physically secured or otherwise controlled to prevent unauthorized access, modification, or substitution while devices are deployed for use. This includes both attended and unattended devices (for example, kiosks, “pay-at-the-pump,” etc.).
- Prevent unauthorized physical access to devices undergoing repair or maintenance while in their possession.
Testing Procedures:
30-1.a Obtain and examine documentation of inventory control and monitoring procedures. Determine that the procedures cover:
- Inventory-control and monitoring procedures to track POI devices in their possession.
- Physically securing POI devices when awaiting deployment or otherwise not in use.
- The prevention and detection of the unauthorized alteration or replacement of POI devices during deployment.
- Ensuring that POI devices are physically secured or otherwise controlled to prevent unauthorized access, modification, or substitution while devices are deployed for use, including both attended and unattended devices (for example, kiosks, “pay-at-the-pump,” etc.).
- Preventing unauthorized physical access to devices undergoing repair or maintenance while in their possession.
30-1.b Interview applicable personnel to determine that procedures are known and followed.
