PCI P2PE 4A-1.1: PCI P2PE 4A-1.1

Each HSM carries either a PCI PTS HSM approval or a Level 3 or higher certification against FIPS 140-2 or its successor 140-3, whose current listing matches the deployed device on vendor, model, hardware and firmware versions and assessed applications (vendor documentation may cover a patched firmware version awaiting validation); it runs in FIPS-approved mode with FIPS-approved primitives, protections and key management, or under written confirmation of any operation outside FIPS mode, and, where PTS-approved, follows the security policy of that approval for all P2PE operations.