At the ACS and DS, the HSM is deployed securely under its security policy: an HSM chosen for its FIPS validation must run only the primitives, data-protection methods and key-management processes FIPS approves, whenever it decrypts account data or does related work; a PCI PTS-approved HSM is configured to run as the security policy submitted with its PTS approval requires, for every operation. The assessor examines the approval documentation or security policy and observes the HSM configuration.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.