PCI P2PE

Self-Assess

Global (PCI Security Standards Council; P2PE solution providers, component providers, application vendors and merchants operating merchant-managed solutions)

v3.1 (September 2021, current)

6 domains

295 controls

The PCI Point-to-Point Encryption Security Requirements and Testing Procedures (PCI Security Standards Council, v3.1, September 2021) set what a P2PE solution must meet for account data to be encrypted in a PCI-approved POI device with SRED and decrypted only in a secured decryption environment, reducing the merchant's PCI DSS scope: Domain 1 encryption device and application management, Domain 2 application security, Domain 3 solution management, Domain 4 the decryption environment, Domain 5 cryptographic key operations and device management (restated from PCI PIN), and Appendix A merchant-managed solutions. The graph models the 295 sub-requirements.

Verified

PCI P2PE is a compliance framework from Global (PCI Security Standards Council; P2PE solution providers, component providers, application vendors and merchants operating merchant-managed solutions) with 6 domains and 295 controls that map to 177 other frameworks. The largest domains are Domain 5: P2PE Cryptographic Key Operations and Device Management – PCI P2PE (137 controls), Domain 4: Decryption Environment – PCI P2PE (68 controls), Domain 2: Application Security – PCI P2PE (37 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Appendix A: Merchant-Managed Solutions (separation of encryption and decryption environments) – PCI P2PE

13 controls

Controls in the Appendix A: Merchant-Managed Solutions (separation of encryption and decryption environments) – PCI P2PE domain of PCI P2PE: 13 controls
Code	Title	Description
pci-p2pe::MM-A-1.1	PCI P2PE MM-A-1.1	Up-to-date documentation, as text or diagrams, sets out the architecture of the merchant-managed solution: its data flow...
pci-p2pe::MM-A-1.2	PCI P2PE MM-A-1.2	Decryption systems sit on a network dedicated to decryption operations, within a cardholder data environment.
pci-p2pe::MM-A-1.3	PCI P2PE MM-A-1.3	Decryption-environment systems are dedicated to decryption and key management or to supporting them, run only the servic...
pci-p2pe::MM-A-1.4	PCI P2PE MM-A-1.4	The systems that authenticate logical access to decryption-environment components are located inside that environment an...
pci-p2pe::MM-A-1.5	PCI P2PE MM-A-1.5	Privileged and administrative logical access to decryption-environment systems is authorised and may only be initiated f...
pci-p2pe::MM-A-1.6	PCI P2PE MM-A-1.6	Every remote access feature on every system in the merchant decryption environment is permanently disabled or otherwise...
pci-p2pe::MM-A-1.7	PCI P2PE MM-A-1.7	No account data is stored on any system within the merchant's decryption environment.
pci-p2pe::MM-A-2.1	PCI P2PE MM-A-2.1	Firewalls sit between the merchant decryption environment and every other network, confining traffic in both directions...
pci-p2pe::MM-A-2.2	PCI P2PE MM-A-2.2	Only the approved POI devices within the encryption environment may exchange inbound or outbound traffic with the mercha...
pci-p2pe::MM-A-2.3	PCI P2PE MM-A-2.3	Unauthorised physical connections to the decryption environment are prevented: wireless connections are prohibited and p...
pci-p2pe::MM-B-1.1	PCI P2PE MM-B-1.1	Network traffic from the encryption environment to any other CDE is confined to the systems that directly support P2PE t...
pci-p2pe::MM-B-1.2	PCI P2PE MM-B-1.2	Processes stop clear-text account data from flowing out of the CDE and back into the encryption environment.
pci-p2pe::MM-C-1.1	PCI P2PE MM-C-1.1	Physical and logical access controls enforce separation of duties so that staff working in the stores (the encryption en...

Domain 1: Encryption Device and Application Management – PCI P2PE

27 controls

Controls in the Domain 1: Encryption Device and Application Management – PCI P2PE domain of PCI P2PE: 27 controls
Code	Title	Description
pci-p2pe::1A-1.1	PCI P2PE 1A-1.1	Account data is encrypted only in a POI device approved under PCI PTS with SRED, the unexpired approval listing matching...
pci-p2pe::1A-1.2	PCI P2PE 1A-1.2	POI devices are set to capture account data only through SRED-validated mechanisms; every other capture mechanism is swi...
pci-p2pe::1A-1.3	PCI P2PE 1A-1.3	A POI device that implements open protocols (link layer, IP, security protocols, IP services) as part of the solution is...
pci-p2pe::1A-1.4	PCI P2PE 1A-1.4	No component or device other than the PCI-approved POI device itself is ever shown clear-text account data.
pci-p2pe::1A-2.1	PCI P2PE 1A-2.1	Each application on a POI device that can reach clear-text account data has been assessed under Domain 2, and the assess...
pci-p2pe::1A-2.2	PCI P2PE 1A-2.2	An application that can reach clear-text account data is deployed only on POI device types that 1A-1.1 has confirmed as...
pci-p2pe::1B-1.1	PCI P2PE 1B-1.1	Merchant logical access to POI devices, where needed at all, is restricted so the merchant cannot view or change device...
pci-p2pe::1B-1.2	PCI P2PE 1B-1.2	Staff of the solution provider who can log on to deployed POI devices are formally listed, approved by management and re...
pci-p2pe::1B-2.1	PCI P2PE 1B-2.1	Solution-provider personnel use multifactor or cryptographic authentication for every remote access to merchant POI devi...
pci-p2pe::1B-2.2	PCI P2PE 1B-2.2	POI devices are set up to accept remote access only from systems the solution provider has authorised, for example its t...
pci-p2pe::1B-2.3	PCI P2PE 1B-2.3	POI devices are configured so that merchants have no remote access to them.
pci-p2pe::1B-2.4	PCI P2PE 1B-2.4	Secure identification and authentication procedures govern all solution-provider access to POI devices deployed at merch...
pci-p2pe::1B-2.5	PCI P2PE 1B-2.5	Each authorised solution-provider employee has individual credentials unique per merchant (or unique per employee where...
pci-p2pe::1B-3.1	PCI P2PE 1B-3.1	Firmware and software updates follow a secure update process that checks the integrity of the update and verifies its or...
pci-p2pe::1B-3.2	PCI P2PE 1B-3.2	An inventory of POI device system builds (model, hardware version, firmware versions, P2PE payment applications and non-...
pci-p2pe::1B-3.3	PCI P2PE 1B-3.3	Critical security updates to software, meaning those that address an imminent risk to account data, are applied to deplo...
pci-p2pe::1B-3.4	PCI P2PE 1B-3.4	Patch and update code is protected against alteration during delivery and deployment, as set out in the application's Im...
pci-p2pe::1B-4.1	PCI P2PE 1B-4.1	PAN or SAD gathered for troubleshooting or debugging is kept to small amounts and collected only when necessary, is encr...
pci-p2pe::1B-5.1	PCI P2PE 1B-5.1	Every change to a critical function of a POI device (application and firmware updates, security-sensitive configuration...
pci-p2pe::1C-1.1	PCI P2PE 1C-1.1	Any whitelisting functionality that lets clear-text data leave the device is implemented so that it can output clear-tex...
pci-p2pe::1C-2.1	PCI P2PE 1C-2.1	Before installation or update, any non-payment software on the device is confirmed to have no logical interface through...
pci-p2pe::1D-1.1	PCI P2PE 1D-1.1	Every change to an application is managed under documented processes that follow the vendor's Implementation Guide, reco...
pci-p2pe::1D-1.2	PCI P2PE 1D-1.2	Every new installation and update of an application is cryptographically signed before installation, by authorised perso...
pci-p2pe::1D-1.3	PCI P2PE 1D-1.3	The guidance on using keys and certificates that the application developer gives in the Implementation Guide is put into...
pci-p2pe::1D-2.1	PCI P2PE 1D-2.1	A current copy of each application vendor's Implementation Guide is retained on receipt and distributed to every outsour...
pci-p2pe::1E-1.1	PCI P2PE 1E-1.1	A component provider of encryption-management services tracks the status of its services and reports to each solution pr...
pci-p2pe::1E-1.2	PCI P2PE 1E-1.2	A component provider of encryption-management services manages and monitors changes to its services and notifies the sol...

Domain 2: Application Security – PCI P2PE

37 controls

Controls in the Domain 2: Application Security – PCI P2PE domain of PCI P2PE: 37 controls
Code	Title	Description
pci-p2pe::2A-1.1	PCI P2PE 2A-1.1	The application is intended for a PTS-approved POI device with SRED, the approval listing matching on model, hardware ve...
pci-p2pe::2A-1.2	PCI P2PE 2A-1.2	The application takes in and processes transactions only through those capture mechanisms of the underlying device that...
pci-p2pe::2A-2.1	PCI P2PE 2A-2.1	The application vendor maintains current documentation of every PAN and SAD flow with a business justification for each...
pci-p2pe::2A-2.2	PCI P2PE 2A-2.2	Once a transaction is finalised the application keeps no PAN, and once authorisation is complete it keeps no SAD, even i...
pci-p2pe::2A-2.3	PCI P2PE 2A-2.3	PAN and SAD are held in working memory no longer than strictly necessary.
pci-p2pe::2A-2.4	PCI P2PE 2A-2.4	Any PAN or SAD stored during processing is securely deleted.
pci-p2pe::2A-3.1	PCI P2PE 2A-3.1	The application outputs no clear-text account data outside the POI device; truncated PANs keep to the digits PCI DSS all...
pci-p2pe::2A-3.2	PCI P2PE 2A-3.2	The application's own logical interfaces pass no clear-text account data to other applications, including non-payment so...
pci-p2pe::2A-3.3	PCI P2PE 2A-3.3	The application communicates externally only through methods covered by the device's PCI PTS evaluation, for example an...
pci-p2pe::2A-3.4	PCI P2PE 2A-3.4	Where the application implements whitelisting, its Implementation Guide tells the installer how to configure it, how to...
pci-p2pe::2B-1.1	PCI P2PE 2B-1.1	The application is developed to industry best practice and the device vendor's security guidance with information securi...
pci-p2pe::2B-1.10	PCI P2PE 2B-1.10	The published versioning methodology is communicated to customers and integrators or resellers.
pci-p2pe::2B-1.11	PCI P2PE 2B-1.11	Where internal version numbers map to the published scheme, the methodology documents the mapping.
pci-p2pe::2B-1.12	PCI P2PE 2B-1.12	A process reviews every application update for conformity with the versioning methodology before release.
pci-p2pe::2B-1.13	PCI P2PE 2B-1.13	A documented process authorises each update and the final release of the application, carrying an authorised party's sig...
pci-p2pe::2B-1.2	PCI P2PE 2B-1.2	Application code and non-code configuration are reviewed before every release or update by someone other than the author...
pci-p2pe::2B-1.3	PCI P2PE 2B-1.3	Every change to the application follows change control with documentation of impact, documented approval by authorised p...
pci-p2pe::2B-1.4	PCI P2PE 2B-1.4	The application is developed to secure coding practice, with least privilege, fail-safe exception handling and defensive...
pci-p2pe::2B-1.5	PCI P2PE 2B-1.5	Developers receive secure development training fitted to their role and technology (secure design, secure coding against...
pci-p2pe::2B-1.6	PCI P2PE 2B-1.6	Secure source-control practices protect source code during development and confirm that it remains intact.
pci-p2pe::2B-1.7	PCI P2PE 2B-1.7	The vendor documents and follows a software-versioning methodology under the P2PE Program Guide that defines the version...
pci-p2pe::2B-1.8	PCI P2PE 2B-1.8	The versioning methodology indicates the type and impact of every change under the Program Guide's change categories, de...
pci-p2pe::2B-1.9	PCI P2PE 2B-1.9	The methodology states whether wildcards are used and how, never for a change with security impact, never in an element...
pci-p2pe::2B-2.1	PCI P2PE 2B-2.1	An application that depends on the Open Protocol functions of the device firmware is built in line with the security gui...
pci-p2pe::2B-2.2	PCI P2PE 2B-2.2	The development process covers secure integration with every resource shared with or between applications.
pci-p2pe::2B-2.3	PCI P2PE 2B-2.3	The application does not bypass or defeat the application segregation the POI device enforces.
pci-p2pe::2B-2.4	PCI P2PE 2B-2.4	The application does not bypass or defeat the operating system hardening the device implements.
pci-p2pe::2B-2.5	PCI P2PE 2B-2.5	The application never circumvents or defeats any account-data security or encryption method that the device implements.
pci-p2pe::2B-2.6	PCI P2PE 2B-2.6	Where the application offers configuration or update functions at the terminal, such as an on-screen menu, those functio...
pci-p2pe::2B-3.1	PCI P2PE 2B-3.1	The developer fully documents and integration-tests the application on its intended platforms, providing security guidan...
pci-p2pe::2B-4.1	PCI P2PE 2B-4.1	The application never encrypts clear-text account data itself or implements any encryption meant to replace or bypass th...
pci-p2pe::2B-4.2	PCI P2PE 2B-4.2	The application cannot decrypt SRED-encrypted account data or otherwise recover the clear-text.
pci-p2pe::2C-1.1	PCI P2PE 2C-1.1	Developers run a process that identifies and tests for security vulnerabilities and implementation errors before every r...
pci-p2pe::2C-1.2	PCI P2PE 2C-1.2	The vendor develops and deploys critical security updates, those addressing an imminent risk to account data, in a timel...
pci-p2pe::2C-2.1	PCI P2PE 2C-2.1	Every application installation and update on a POI device is cryptographically authenticated by the device firmware's ap...
pci-p2pe::2C-3.1	PCI P2PE 2C-3.1	The Implementation Guide is written, maintained and circulated so that it covers each Domain 2 requirement that points t...
pci-p2pe::2C-3.2	PCI P2PE 2C-3.2	Training and communication programmes make sure that installers (solution providers, resellers and integrators) understa...

Domain 3: P2PE Solution Management – PCI P2PE

13 controls

Controls in the Domain 3: P2PE Solution Management – PCI P2PE domain of PCI P2PE: 13 controls
Code	Title	Description
pci-p2pe::3A-1.1	PCI P2PE 3A-1.1	Current documentation describes or illustrates the whole solution's architecture, identifying every part, the parts perf...
pci-p2pe::3A-1.2	PCI P2PE 3A-1.2	Current documentation with a data-flow diagram traces account data from capture and encryption in the POI device to decr...
pci-p2pe::3A-1.3	PCI P2PE 3A-1.3	Where a regional legal or regulatory obligation requires full PAN on merchant receipts, the solution provider documents...
pci-p2pe::3A-2.1	PCI P2PE 3A-2.1	When component providers are used, a methodology makes sure a status report arrives from each of them, is checked for th...
pci-p2pe::3A-2.2	PCI P2PE 3A-2.2	Processes keep the P2PE controls in place through changes to the solution, including changes of third-party providers an...
pci-p2pe::3A-3.1	PCI P2PE 3A-3.1	Processes handle reports of suspicious activity that merchants, component providers or other third parties send in (phys...
pci-p2pe::3A-3.2	PCI P2PE 3A-3.2	When suspicious activity is detected, the POI device is at once removed, powered down or disconnected, and stays out of...
pci-p2pe::3A-3.3	PCI P2PE 3A-3.3	A record of all suspicious activity is kept for at least a year, identifying the devices and merchant affected, the date...
pci-p2pe::3A-3.4	PCI P2PE 3A-3.4	Procedures incorporate the payment brands' incident response requirements, reporting time frames included.
pci-p2pe::3A-3.5	PCI P2PE 3A-3.5	P2PE control failures are addressed under a process that identifies the failure, finds the root cause, determines the re...
pci-p2pe::3B-1.1	PCI P2PE 3B-1.1	Formal agreements with every third party performing P2PE functions for the solution provider set out each party's functi...
pci-p2pe::3C-1.1	PCI P2PE 3C-1.1	The P2PE Instruction Manual follows the Council's mandatory PIM template and is maintained, distributed to merchants and...
pci-p2pe::3C-1.2.1	PCI P2PE 3C-1.2.1	Merchants affected by a change to the PIM are told about it, and a revised PIM is supplied to them where needed.

Domain 4: Decryption Environment – PCI P2PE

68 controls

Controls in the Domain 4: Decryption Environment – PCI P2PE domain of PCI P2PE: 68 controls
Code	Title	Description
pci-p2pe::4A-1.1	PCI P2PE 4A-1.1	Each HSM carries either a PCI PTS HSM approval or a Level 3 or higher certification against FIPS 140-2 or its successor...
pci-p2pe::4B-1.1	PCI P2PE 4B-1.1	Current documentation describes or illustrates the decryption environment's configuration, including the data flow and c...
pci-p2pe::4B-1.2	PCI P2PE 4B-1.2	Decryption devices are administered securely by authorised personnel under procedures for administrative roles, user int...
pci-p2pe::4B-1.3	PCI P2PE 4B-1.3	Only authorised users and processes can call the HSM, for instance through authenticated API use with credentials protec...
pci-p2pe::4B-1.4	PCI P2PE 4B-1.4	The decryption environment authenticates each unique POI device it communicates with, on request by the solution provide...
pci-p2pe::4B-1.5	PCI P2PE 4B-1.5	Authorised personnel inspect decryption devices, their cabling and connection points and physically connected devices at...
pci-p2pe::4B-1.6	PCI P2PE 4B-1.6	The decryption environment is secured to PCI DSS; for a merchant-managed solution that validation is the merchant's unde...
pci-p2pe::4B-1.7	PCI P2PE 4B-1.7	Clear-text account data never returns to the encryption environment, apart from clear-text data confirmed under the whit...
pci-p2pe::4B-1.8	PCI P2PE 4B-1.8	Any truncated PAN sent back to the encryption environment keeps to the digits PCI DSS and its FAQs allow.
pci-p2pe::4B-1.9	PCI P2PE 4B-1.9	Any whitelisting in the decryption environment that sends data to the encryption environment permits clear-text output o...
pci-p2pe::4C-1.1	PCI P2PE 4C-1.1	Every change to a decryption device's critical functions, for example firmware and application updates, key injection an...
pci-p2pe::4C-1.2	PCI P2PE 4C-1.2	Mechanisms detect suspicious activity and respond to it, including: physical breaches; devices that are tampered with, m...
pci-p2pe::4C-1.3	PCI P2PE 4C-1.3	Mechanisms detect encryption failures by monitoring all traffic received for clear-text account data output by a misconf...
pci-p2pe::4C-1.4	PCI P2PE 4C-1.4	All suspicious activity is identified and recorded for at least a year with the devices and merchant affected, the date...
pci-p2pe::4C-1.5	PCI P2PE 4C-1.5	Immediate notification of suspicious activity goes to the applicable parties: merchants, processors, acquirers and any s...
pci-p2pe::4D-1.1	PCI P2PE 4D-1.1	The solution provider maintains current documentation of the Host System's configuration, including data flow and connec...
pci-p2pe::4D-1.10	PCI P2PE 4D-1.10	The Host System performs no cryptographic operation while in an error state, during self-tests or during diagnostics of...
pci-p2pe::4D-1.11	PCI P2PE 4D-1.11	The Host System's cryptographic software and firmware, in both source and executable form, are protected against unautho...
pci-p2pe::4D-1.12	PCI P2PE 4D-1.12	Clear-text data-decryption keys are inaccessible to any process or function not directly required for decryption.
pci-p2pe::4D-1.13	PCI P2PE 4D-1.13	Only authorised staff whose job gives them a defined need can reach clear-text data-decryption keys.
pci-p2pe::4D-1.14	PCI P2PE 4D-1.14	The Host System never writes clear-text keys to persistent storage except in swap or page files and troubleshooting core...
pci-p2pe::4D-1.2	PCI P2PE 4D-1.2	The Host System is isolated or dedicated to payment transaction processing, with only the necessary services, protocols...
pci-p2pe::4D-1.3	PCI P2PE 4D-1.3	The HSM and Host System are placed on a network used only for decryption and transaction processing, segmented from any...
pci-p2pe::4D-1.4	PCI P2PE 4D-1.4	Every application installed on the Host System is authorised and has a business justification.
pci-p2pe::4D-1.5	PCI P2PE 4D-1.5	An automated or manual process prevents, or detects and alerts on, unauthorised changes to the Host System's software.
pci-p2pe::4D-1.6	PCI P2PE 4D-1.6	On power-up the Host System self-tests the integrity of its cryptographic functions, its firmware and every security fun...
pci-p2pe::4D-1.7	PCI P2PE 4D-1.7	The Host System self-tests again whenever a security-impacting function is modified, such as an integrity check on loadi...
pci-p2pe::4D-1.8	PCI P2PE 4D-1.8	When a cryptographic operation, a self-test or a security function fails, the Host System goes into an error state, halt...
pci-p2pe::4D-1.9	PCI P2PE 4D-1.9	Host System alerts are documented, notify authorised personnel and start a response procedure.
pci-p2pe::4D-2.1	PCI P2PE 4D-2.1	Every Host System user password is changed at least every 30 days, whatever the user's role.
pci-p2pe::4D-2.2	PCI P2PE 4D-2.2	User passwords are at least eight characters mixing numeric and alphabetic characters, or of equivalent strength under c...
pci-p2pe::4D-2.3	PCI P2PE 4D-2.3	Where log-on tokens such as smart cards are used they require a usage-authentication mechanism, a biometric or a PIN or...
pci-p2pe::4D-2.4	PCI P2PE 4D-2.4	A user account locks after no more than five unsuccessful attempts.
pci-p2pe::4D-2.5	PCI P2PE 4D-2.5	The Host System enforces role-based access with at least an operator role for day-to-day use, an administrator role for...
pci-p2pe::4D-2.6	PCI P2PE 4D-2.6	Segregation of duties between roles, enforced by automated or manual means, keeps any one person from controlling an end...
pci-p2pe::4D-2.7	PCI P2PE 4D-2.7	Any change to what a user may access goes through formal change control, involves two or more people and is documented.
pci-p2pe::4D-2.8	PCI P2PE 4D-2.8	Every quarter or more often, all physical and logical access rights are reviewed to confirm that each person who can rea...
pci-p2pe::4D-2.9	PCI P2PE 4D-2.9	Tamper detection on the Host System raises an alert when its case, covers or doors are opened.
pci-p2pe::4D-3.1	PCI P2PE 4D-3.1	Every non-console connection to the Host System uses secure protocols and strong cryptography.
pci-p2pe::4D-3.2	PCI P2PE 4D-3.2	Non-console access gives no access to any service or channel beyond the connection to the host, with no split tunnelling...
pci-p2pe::4D-3.3	PCI P2PE 4D-3.3	Multifactor authentication is required for every non-console connection.
pci-p2pe::4D-3.4	PCI P2PE 4D-3.4	Non-console connections are permitted only from authorised systems.
pci-p2pe::4D-3.5	PCI P2PE 4D-3.5	Non-console access starts only from an environment that complies with PCI DSS: the originating system satisfies the rele...
pci-p2pe::4D-3.6	PCI P2PE 4D-3.6	Users of non-console connections are individually authorised to use them.
pci-p2pe::4D-3.7	PCI P2PE 4D-3.7	The Host ends any non-console session that stays idle for 15 minutes.
pci-p2pe::4D-4.1	PCI P2PE 4D-4.1	The Host System sits in a physically secure room, or secure rack, dedicated to decryption and transaction processing.
pci-p2pe::4D-4.10	PCI P2PE 4D-4.10	Lighting suited to the cameras, either continuous or motion-triggered, is installed unless the cameras can record images...
pci-p2pe::4D-4.11	PCI P2PE 4D-4.11	A physical intrusion-detection system operates around the clock, for example motion detectors while the room is empty, f...
pci-p2pe::4D-4.12	PCI P2PE 4D-4.12	Any window in the secure room is locked, protected by alarmed sensors or similarly secured.
pci-p2pe::4D-4.13	PCI P2PE 4D-4.13	Any window is covered, opaque or positioned so the room cannot be observed.
pci-p2pe::4D-4.14	PCI P2PE 4D-4.14	An uninterruptible power supply backs the access-control and monitoring systems.
pci-p2pe::4D-4.15	PCI P2PE 4D-4.15	Every alarm event is logged.
pci-p2pe::4D-4.16	PCI P2PE 4D-4.16	An authorised person who had no part in an alarm event signs off its documentation.
pci-p2pe::4D-4.17	PCI P2PE 4D-4.17	Opening any emergency exit or entrance triggers an alarm event.
pci-p2pe::4D-4.18	PCI P2PE 4D-4.18	Authorised personnel respond to every physical intrusion alarm within 30 minutes.
pci-p2pe::4D-4.19	PCI P2PE 4D-4.19	Clocks on the access-control, intrusion-detection and camera systems are kept synchronised automatically or by hand; man...
pci-p2pe::4D-4.2	PCI P2PE 4D-4.2	Everyone is identified and authenticated, by badge system or biometrics for instance, before entering the secure room.
pci-p2pe::4D-4.20	PCI P2PE 4D-4.20	The secure room's entrance has a mechanism that keeps the door from being left open, such as contact monitoring with aut...
pci-p2pe::4D-4.21	PCI P2PE 4D-4.21	If the entrance is held open longer than 30 seconds, an audible alarm goes off.
pci-p2pe::4D-4.3	PCI P2PE 4D-4.3	Every physical entry into the secure room is monitored and logged, with logs kept for three years or more and reviewed r...
pci-p2pe::4D-4.4	PCI P2PE 4D-4.4	Entry to the secure room that houses the Host System requires dual access.
pci-p2pe::4D-4.5	PCI P2PE 4D-4.5	Only designated staff whose duties and business needs are defined may enter physically.
pci-p2pe::4D-4.6	PCI P2PE 4D-4.6	CCTV watches the secure room at all hours, covering as a minimum each entrance and exit and the points of access to the...
pci-p2pe::4D-4.7	PCI P2PE 4D-4.7	Cameras are placed so that they cannot record keyboards, computer screens, PIN pads or any other display of sensitive da...
pci-p2pe::4D-4.8	PCI P2PE 4D-4.8	CCTV footage is archived securely for 45 days or longer, with enough capacity and redundancy to rebuild the latest 45 da...
pci-p2pe::4D-4.9	PCI P2PE 4D-4.9	People who can enter the secure room cannot reach the media on which surveillance footage is recorded.
pci-p2pe::4E-1.1	PCI P2PE 4E-1.1	A component provider of decryption-management services tracks the status of its services and reports to each solution pr...
pci-p2pe::4E-1.2	PCI P2PE 4E-1.2	A component provider offering decryption-management services manages and monitors changes to its services and tells the...

Domain 5: P2PE Cryptographic Key Operations and Device Management – PCI P2PE

137 controls

Controls in the Domain 5: P2PE Cryptographic Key Operations and Device Management – PCI P2PE domain of PCI P2PE: 137 controls
Code	Title	Description
pci-p2pe::1-2	PCI P2PE 1-2	A key-injection facility injects keys only into equipment that meets the requirements for secure cryptographic devices.
pci-p2pe::1-3	PCI P2PE 1-3	Each HSM holds a current, unexpired FIPS 140-2 or 140-3 certification at Level 3 or above, or a PCI approval (a FIPS cer...
pci-p2pe::1-4	PCI P2PE 1-4	For each deployed HSM the approval listing matches the vendor, model, hardware version and firmware version, the FIPS 14...
pci-p2pe::1-5	PCI P2PE 1-5	A KIF platform provider keeps current documentation of the KIF's architecture and all its functions, and of how keys flo...
pci-p2pe::10-1	PCI P2PE 10-1	Any key-encryption key used to send or convey another key is at least equal in strength to the key it protects under Ann...
pci-p2pe::11-1	PCI P2PE 11-1	Written procedures for key transmission and conveyance exist and are known to everyone affected.
pci-p2pe::11-2	PCI P2PE 11-2	The methods used to convey and receive keys are documented.
pci-p2pe::12-1	PCI P2PE 12-1	Keys loaded from individual components or shares are loaded under dual control and split knowledge, whether the media ar...
pci-p2pe::12-2	PCI P2PE 12-2	When components are removed from storage for loading and put back afterwards, procedures stop any single individual from...
pci-p2pe::12-3	PCI P2PE 12-3	Loading clear-text keys with a key-loading device needs dual control to authorise each session so that no single person...
pci-p2pe::12-4	PCI P2PE 12-4	Symmetric key components are combined in a way that leaves every active bit of the key undeterminable unless all the oth...
pci-p2pe::12-5	PCI P2PE 12-5	HSM master file keys, including any generated inside the HSM that never leave it, are AES keys of 128 bits or longer.
pci-p2pe::12-6	PCI P2PE 12-6	Every other SCD loaded with the same components combines them by the identical process.
pci-p2pe::12-7	PCI P2PE 12-7	The first terminal master key or initial DUKPT key is loaded using asymmetric techniques or manually through the keypad,...
pci-p2pe::12-8	PCI P2PE 12-8	Where secret keys are distributed remotely using public-key protocols, the Domain's remote key-distribution requirements...
pci-p2pe::12-9	PCI P2PE 12-9	A key-injection facility implements dual control and split knowledge for loading keys into POIs and other SCDs, through...
pci-p2pe::13-1	PCI P2PE 13-1	Clear-text keys and components enter an SCD only when cameras cannot see the entry, no mechanism at the interface betwee...
pci-p2pe::13-2	PCI P2PE 13-2	Outside a secure key-loading facility meeting this Domain, only SCDs load clear-text keys or components; computer keyboa...
pci-p2pe::13-3	PCI P2PE 13-3	When a plaintext component or share is loaded straight from electronic media such as a smart card, thumb drive or fob in...
pci-p2pe::13-4	PCI P2PE 13-4	Where keys move from the equipment that generated them to an electronic key-loading device, that device must meet these...
pci-p2pe::13-5	PCI P2PE 13-5	Media carrying components or shares for key loading are kept in secure storage that only the authorised custodians can r...
pci-p2pe::13-6	PCI P2PE 13-6	A human-readable component, such as one printed in a PIN mailer, is visible only to its custodian and only for as long a...
pci-p2pe::13-7	PCI P2PE 13-7	Written or printed component documents stay sealed until immediately before use.
pci-p2pe::13-8	PCI P2PE 13-8	Nobody who can reach a component or share of a key, or the medium holding it, can also reach enough of that key's other...
pci-p2pe::13-9	PCI P2PE 13-9	A key-injection facility that loads keys with PC-based software or similar devices such as modified PEDs, where clear-te...
pci-p2pe::14-1	PCI P2PE 14-1	The hardware, and the passwords or authentication codes, used for loading keys or signing authenticated applications are...
pci-p2pe::14-2	PCI P2PE 14-2	Every cable over which clear-text keying material passes is examined at the start of key-activity operations, at power-o...
pci-p2pe::14-3	PCI P2PE 14-3	The use of key-loading equipment is monitored, and each loading activity is logged with, as a minimum, the date and time...
pci-p2pe::14-4	PCI P2PE 14-4	Physical tokens such as brass keys or chip cards that enable key loading or application signing are never in the control...
pci-p2pe::14-5	PCI P2PE 14-5	Default passwords or authentication codes that enforce dual control are changed, and documented procedures require them...
pci-p2pe::15-1	PCI P2PE 15-1	A cryptographic validation mechanism, such as hashes or key check values under ISO 11568, confirms that loaded keys and...
pci-p2pe::15-2	PCI P2PE 15-2	A public key's authenticity and integrity are ensured by encrypting it per Annex C or, if in plaintext, by holding it in...
pci-p2pe::15-3	PCI P2PE 15-3	Controls stop an unauthorised key-distribution host from transporting, exchanging or establishing keys with POIs: where...
pci-p2pe::15-4	PCI P2PE 15-4	Key-establishment and distribution designs leave no opening for man-in-the-middle attacks, for instance by binding the K...
pci-p2pe::15-5	PCI P2PE 15-5	In the CA and RA context too, an externally generated key pair is transferred and loaded securely with the private key k...
pci-p2pe::16-1	PCI P2PE 16-1	Documented key-loading procedures exist for every device type, HSMs and POIs included, and everyone involved in loading...
pci-p2pe::16-2	PCI P2PE 16-2	Every key-loading event is documented and covered by an audit trail.
pci-p2pe::17-1	PCI P2PE 17-1	A key shared by two entities or logically separate systems to encrypt account data between them, including the KEK that...
pci-p2pe::18-1	PCI P2PE 18-1	Synchronisation errors are monitored and repeated errors in online key exchanges, transmission or processing of account...
pci-p2pe::18-2	PCI P2PE 18-2	Component packaging or containers showing signs of tampering are assessed and the analysis documented, and a confirmed c...
pci-p2pe::18-3	PCI P2PE 18-3	Encrypted symmetric keys are managed in key blocks that cryptographically bind the key's usage to the key, by phases: in...
pci-p2pe::18-4	PCI P2PE 18-4	POIs talk to a certification authority solely to have certificates signed (or for key injection where the CA generates t...
pci-p2pe::18-5	PCI P2PE 18-5	KDHs talk to POIs solely for normal transaction processing and key management, and talk to CAs solely to have certificat...
pci-p2pe::18-6	PCI P2PE 18-6	Controls prevent any single person from loading unencrypted secret or private keys or components, and detect any attempt...
pci-p2pe::18-7	PCI P2PE 18-7	A key-injection facility protects against unauthorised key substitution and against devices operating without legitimate...
pci-p2pe::19-1	PCI P2PE 19-1	Each key is used only for its intended purpose: key-encryption keys never encrypt account data, account-data keys never...
pci-p2pe::19-10	PCI P2PE 19-10	Public-key implementations limit and govern how public and private keys may be used, for example by means of X.509 certi...
pci-p2pe::19-11	PCI P2PE 19-11	CA private keys are never shared among devices, other than for disaster recovery and load balancing.
pci-p2pe::19-12	PCI P2PE 19-12	Certificates used for remote key distribution serve a single purpose each: encryption certificates, KDH authentication c...
pci-p2pe::19-2	PCI P2PE 19-2	A private key is used for one purpose only, decryption or signing but not both except in transaction-originating POI dev...
pci-p2pe::19-3	PCI P2PE 19-3	A public key is used only for encryption or only for verifying signatures, not both, except in transaction-originating P...
pci-p2pe::19-4	PCI P2PE 19-4	Production and test or development keys are never shared or substituted: no production key exists in a test system and n...
pci-p2pe::19-5	PCI P2PE 19-5	A production HSM and its server may serve temporarily for testing only where a business rationale exists and all keying...
pci-p2pe::19-6	PCI P2PE 19-6	CA key pairs are not reused for certificate renewal or replacement; each new certificate rests on a newly generated pair...
pci-p2pe::19-7	PCI P2PE 19-7	KDH private keys are never shared among devices, other than for disaster recovery and load balancing.
pci-p2pe::19-8	PCI P2PE 19-8	POI private keys are never shared between devices.
pci-p2pe::19-9	PCI P2PE 19-9	Mechanisms confine every key to its designated purpose so that keys are used in accordance with the certificate policy,...
pci-p2pe::20-1	PCI P2PE 20-1	Each POI device holds unique secret and private keys for every function bearing on the protection of account data, known...
pci-p2pe::20-2	PCI P2PE 20-2	Where a POI device connects directly to several entities that decrypt its account data, such as different acquirers, it...
pci-p2pe::20-3	PCI P2PE 20-3	Keys derived from a single base derivation key use unique derivation data under ISO 11568 so that each device gets its o...
pci-p2pe::20-4	PCI P2PE 20-4	Where an entity processes or injects DUKPT or other derived keys for more than one acquirer, it segments its environment...
pci-p2pe::20-5	PCI P2PE 20-5	A key-injection facility loading DUKPT keys for several POI types for one entity uses separate BDKs per terminal type wh...
pci-p2pe::20-6	PCI P2PE 20-6	A key-injection facility involved in remote key establishment and distribution makes each key uniquely identifiable acro...
pci-p2pe::21-1	PCI P2PE 21-1	A secret or private key exists only in one of these forms: at least two separate full-length components or shares; encry...
pci-p2pe::21-2	PCI P2PE 21-2	Wherever components or shares are used they have the four properties below. In particular: knowledge of one component or...
pci-p2pe::21-3	PCI P2PE 21-3	Components and shares are stored securely. In particular: each clear-text component held outside an SCD is sealed on its...
pci-p2pe::21-4	PCI P2PE 21-4	CA private keys that sign certificates, status lists or messages or protect keys exist only inside a PCI PTS or FIPS 140...
pci-p2pe::22-1	PCI P2PE 22-1	Procedures for keys known or suspected to be compromised cover the five elements below. In particular: components or sha...
pci-p2pe::22-2	PCI P2PE 22-2	A key or component whose loading into a KLD, POI device or hybrid Host System failed is loaded into a replacement only o...
pci-p2pe::22-3	PCI P2PE 22-3	Root CAs segment risk against key compromise, for instance through subordinate CAs.
pci-p2pe::22-4	PCI P2PE 22-4	Mechanisms deal with CA compromise arising from key compromise or poor key handling, including procedures to notify affe...
pci-p2pe::22-5	PCI P2PE 22-5	The CA system uses at least RSA 2048 or equivalent strength for root and subordinate CAs, POI devices and KDHs, and KDH...
pci-p2pe::23-1	PCI P2PE 23-1	A key generated by a reversible process from another key, such as a variant, is protected like the original under dual c...
pci-p2pe::23-2	PCI P2PE 23-2	A host MFK and its variants, which encipher keys held in local storage, are used only within the logical configuration i...
pci-p2pe::23-3	PCI P2PE 23-3	Reversible transformations are never used across levels of the key hierarchy: no working key such as a data-encryption k...
pci-p2pe::24-1	PCI P2PE 24-1	Every instance of a secret or private key, and of each of its components, is destroyed once they have been replaced or a...
pci-p2pe::24-2	PCI P2PE 24-2	Documented procedures govern the destruction of unused or replaced components and shares so that nothing recoverable rem...
pci-p2pe::25-1	PCI P2PE 25-1	The number of key custodians is kept to the minimum operations require. In particular: custodians for each component are...
pci-p2pe::25-2	PCI P2PE 25-2	Every user access to material that could be used to build keys, such as components or shares, can be traced to one indiv...
pci-p2pe::25-3	PCI P2PE 25-3	The system enforces a certification practice statement and certificate security policy that are explicit and clearly def...
pci-p2pe::25-4	PCI P2PE 25-4	Critical CA functions are separated among people so that no one can misuse a CA system undetected, with multi-person con...
pci-p2pe::25-5	PCI P2PE 25-5	CA systems that are not operated wholly offline are hardened against insecure network access: services that are not need...
pci-p2pe::25-6	PCI P2PE 25-6	Every key-management operation (generating, loading, transmitting, backing up, recovering, compromise handling, destroyi...
pci-p2pe::25-7	PCI P2PE 25-7	CA application logs carry a digital signature or an ISO 16609 symmetric MAC so that alteration is detectable, with the s...
pci-p2pe::25-8	PCI P2PE 25-8	User authentication on each CA system component: initial passphrases are pre-expired; group, shared and generic accounts...
pci-p2pe::26-1	PCI P2PE 26-1	Every removal of keys, components or related material from secure storage and every load to an SCD is logged, the logs a...
pci-p2pe::27-1	PCI P2PE 27-1	Backup copies of secret or private keys are kept under the same requirements as the primary keys.
pci-p2pe::27-2	PCI P2PE 27-2	Creating or cloning top-level keys such as MFKs for backup needs at least two authorised people, and every requirement f...
pci-p2pe::28-1	PCI P2PE 28-1	Written procedures for key administration exist and are known, each administration activity is recorded, and the program...
pci-p2pe::28-2	PCI P2PE 28-2	CA operations serve only to issue and manage certificates, and every physical and logical CA component is kept separate...
pci-p2pe::28-3	PCI P2PE 28-3	Each CA operator develops a certification practice statement in the manner of RFC 3647, consistent with this standard, a...
pci-p2pe::28-4	PCI P2PE 28-4	Each CA operator develops a certificate policy in the manner of RFC 3647.
pci-p2pe::28-5	PCI P2PE 28-5	Before a certificate is issued for a public key whose request did not originate in the same Level 3 secure room, documen...
pci-p2pe::29-1	PCI P2PE 29-1	HSMs, PEDs, ATMs and other SCDs, including those used for code signing or key injection, go into service only once there...
pci-p2pe::29-2	PCI P2PE 29-2	A documented chain of custody controls every device from receipt to placement into service, with records naming the pers...
pci-p2pe::29-3	PCI P2PE 29-3	Devices are physically protected from the manufacturer to key insertion and deployment by a trusted courier with secure...
pci-p2pe::29-4	PCI P2PE 29-4	Dual-control mechanisms prevent substitution or tampering of HSMs, deployed, spare and backup, throughout their life, wi...
pci-p2pe::29-5	PCI P2PE 29-5	HSMs stay in tamper-evident packaging or secure storage until ready for installation.
pci-p2pe::30-3	PCI P2PE 30-3	Key-injection operations run against and are reconciled to an inventory of pre-authorised devices: each production run h...
pci-p2pe::31-1	PCI P2PE 31-1	Procedures protect SCDs that are retired or sent back for repair from interception or misuse, and make every key, piece...
pci-p2pe::32-1	PCI P2PE 32-1	HSMs and other SCDs that generate or load keys for POI devices, or that sign applications or whitelists loaded into POI...
pci-p2pe::32-3	PCI P2PE 32-3	The secure room has continuous intrusion detection, with motion detectors armed whenever nobody is inside. In particular...
pci-p2pe::32-4	PCI P2PE 32-4	Everyone other than CA personnel signs in to a paper access log on entry to the Level 3 area, on top of the records the...
pci-p2pe::32-5	PCI P2PE 32-5	An uninterruptible power supply backs every access-control and monitoring system, including intrusion detection.
pci-p2pe::32-6	PCI P2PE 32-6	Each alarm event is documented. In particular: a person involved in an alarm event may not sign it off; opening any emer...
pci-p2pe::32-7	PCI P2PE 32-7	The access-control, intrusion-detection and camera systems keep synchronised clocks, by automatic or manual means, so th...
pci-p2pe::32-8	PCI P2PE 32-8	Distributed KIF functions that generate and transfer keys talk to each other only over mutually authenticated channels,...
pci-p2pe::32-9	PCI P2PE 32-9	A KIF where any key or component appears in memory outside an SCD during injection has a physically secure injection roo...
pci-p2pe::33-1	PCI P2PE 33-1	Written procedures covering the security and integrity of equipment that processes account data exist and are known to a...
pci-p2pe::5-1	PCI P2PE 5-1	Keys, components and shares are generated inside an SCD by an approved key-generation function, either of a PCI-approved...
pci-p2pe::5A-1.1	PCI P2PE 5A-1.1	Only the approved encryption algorithms and key sizes of Normative Annex C protect account data and cryptographic keys.
pci-p2pe::5A-1.2	PCI P2PE 5A-1.2	Keys are replaced once their crypto-period expires; the application vendor or key owner defines that period from industr...
pci-p2pe::5A-1.3	PCI P2PE 5A-1.3	Documentation of the key-management solution's architecture, devices and protocols, set-up and operation exists and is i...
pci-p2pe::5H-1.1	PCI P2PE 5H-1.1	Data decryption keys used in software on the Host System have defined usage limits: either a defined usage period after...
pci-p2pe::5H-1.2	PCI P2PE 5H-1.2	DDKs are erased from the Host System's volatile memory by a mechanism that leaves them unrecoverable and unreconstructab...
pci-p2pe::5H-1.3	PCI P2PE 5H-1.3	A DDK produced from a master key comes from a one-way derivation, the DDK is never a variant of the HSM's master file ke...
pci-p2pe::5H-1.4	PCI P2PE 5H-1.4	The DDK is kept encrypted while it passes from HSM to Host System, either under a fixed transport key or through a crypt...
pci-p2pe::5H-1.5	PCI P2PE 5H-1.5	The key protecting the DDK in transit is no weaker than the DDK, is unique to each Host System, is used solely to encryp...
pci-p2pe::5I-1.1	PCI P2PE 5I-1.1	A component provider that performs key management keeps track of the status of the key-management services it delivers f...
pci-p2pe::6-1	PCI P2PE 6-1	Controls such as tamper detection and dual control stop keys or components from being disclosed without authorisation wh...
pci-p2pe::6-2	PCI P2PE 6-2	General-purpose computers are not used to generate keys where a secret or private key or component would sit unencrypted...
pci-p2pe::6-3	PCI P2PE 6-3	Printed components are placed in blind mailers or authenticable tamper-evident packaging the moment they are printed, so...
pci-p2pe::6-4	PCI P2PE 6-4	Anything left over from key generation that might contain a clear-text key or component, for example printer ribbons, wa...
pci-p2pe::6-5	PCI P2PE 6-5	An asymmetric key pair is generated inside the device that will use it; where it is generated elsewhere, the pair, toget...
pci-p2pe::6-6	PCI P2PE 6-6	Policy and procedures prevent clear-text private or secret keys, components or shares from crossing insecure channels: n...
pci-p2pe::7-1	PCI P2PE 7-1	Every key created is covered by written policies and procedures for key generation, and custodians, supervisors and tech...
pci-p2pe::7-2	PCI P2PE 7-2	The generation of higher-level keys, for example KEKs shared with other organisations, MFKs and BDKs, is logged with the...
pci-p2pe::8-1	PCI P2PE 8-1	A key is moved in one of three forms: encrypted, split into at least two full-length clear-text components or shares, or...
pci-p2pe::8-2	PCI P2PE 8-2	Nobody who can reach one of a key's components or shares, or the medium carrying it, can also reach enough of its other...
pci-p2pe::8-3	PCI P2PE 8-3	E-mail is never used to convey secret or private keys, components or shares, even encrypted, unless the key was already...
pci-p2pe::8-4	PCI P2PE 8-4	Public keys are conveyed with their integrity and authenticity protected: in a certificate from a trusted CA meeting thi...
pci-p2pe::9-1	PCI P2PE 9-1	In transit, every clear-text component or share is always either continuously supervised by a person authorised to handl...
pci-p2pe::9-2	PCI P2PE 9-2	Tamper-evident packaging holding clear-text components is examined before opening; any sign of tampering is assessed and...
pci-p2pe::9-3	PCI P2PE 9-3	Only the authorised custodian and designated backups physically touch a component before it is sealed for transmittal an...
pci-p2pe::9-4	PCI P2PE 9-4	Mechanisms make sure that only authorised custodians place components into packaging that is authenticable, tamper-evide...
pci-p2pe::9-5	PCI P2PE 9-5	Clear-text components not inside an SCD travel in pre-numbered tamper-evident authenticable bags, and the bag numbers ar...
pci-p2pe::9-6	PCI P2PE 9-6	Components or shares of several keys for one custodian or custodian group may share one tamper-evident authenticable bag...

Your Compliance Coverage

If you comply with PCI P2PE, you already cover:

PSD2 SCA

15 controls mapped

Compare →

FFIEC IT Examination Handbook

15 controls mapped

Compare →

PCI SSF

15 controls mapped

Compare →

+ 174 more: PCI PIN Security (4%), Singapore Government Instruction Manual on ICT&SS Management (IM8) (4%)

See all 177 mapped frameworks ↓

Maps to 177 other frameworks

339 total controls

PSD2 SCA

15 source controls mapped|4 target controls covered

FFIEC IT Examination Handbook

15 source controls mapped|15 target controls covered

PCI SSF

15 source controls mapped|16 target controls covered

PCI PIN Security

15 source controls mapped|17 target controls covered

Singapore Government Instruction Manual on ICT&SS Management (IM8)

13 source controls mapped|10 target controls covered

NIST Cybersecurity Framework 2.0

12 source controls mapped|15 target controls covered

South Korea ISMS-P

12 source controls mapped|8 target controls covered

FFIEC Cybersecurity Assessment Tool (CAT)

12 source controls mapped|6 target controls covered

ISO 28001:2007 Supply Chain Security Management

10 source controls mapped|4 target controls covered

Annex 11 to EU GMP - Computerised Systems

10 source controls mapped|6 target controls covered

SOC for Cybersecurity - Cybersecurity Risk Management Examination

10 source controls mapped|7 target controls covered

SSAE 18 - Attestation Standards (SOC Reporting)

10 source controls mapped|7 target controls covered

ASD Strategies to Mitigate Cyber Security Incidents

10 source controls mapped|14 target controls covered

NIST SP 1800-32

9 source controls mapped|7 target controls covered

NIST SP 800-53 Rev 5

9 source controls mapped|14 target controls covered

API 1164

9 source controls mapped|7 target controls covered

ISO/IEC 27019:2024

9 source controls mapped|7 target controls covered

APRA CPS 234

9 source controls mapped|6 target controls covered

IEC 62443

9 source controls mapped|7 target controls covered

Security of Critical Infrastructure Act 2018 (SOCI)

9 source controls mapped|8 target controls covered

TISAX - Trusted Information Security Assessment Exchange

9 source controls mapped|6 target controls covered

APRA CPS 230 Operational Risk Management

8 source controls mapped|5 target controls covered

NIST Privacy Framework

8 source controls mapped|5 target controls covered

ISO 22320:2018

8 source controls mapped|7 target controls covered

UK Open Banking Standard

8 source controls mapped|6 target controls covered

NIST SP 800-190

8 source controls mapped|7 target controls covered

ITIL 4

7 source controls mapped|3 target controls covered

ASIS SPC.1-2009 - Organizational Resilience Standard

7 source controls mapped|5 target controls covered

ISO/IEC 20000-1:2018

7 source controls mapped|3 target controls covered

SOC 2

7 source controls mapped|6 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

7 source controls mapped|8 target controls covered

ISO/IEC 27400:2022

7 source controls mapped|5 target controls covered

ISO/IEC 27010:2015

7 source controls mapped|4 target controls covered

UK AI Regulation Framework

6 source controls mapped|2 target controls covered

SASB Standards

6 source controls mapped|6 target controls covered

EASA Part-IS - Information Security in Aviation

6 source controls mapped|6 target controls covered

BS 65000:2014 - Guidance on Organizational Resilience

6 source controls mapped|3 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

6 source controls mapped|5 target controls covered

Telecommunications Sector Security Reforms (TSSR)

6 source controls mapped|2 target controls covered

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

6 source controls mapped|4 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

6 source controls mapped|3 target controls covered

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)

6 source controls mapped|6 target controls covered

IEC 62304:2015 Medical Device Software Lifecycle Processes

5 source controls mapped|6 target controls covered

FBI CJIS Security Policy

5 source controls mapped|4 target controls covered

IEC 62351 - Power Systems Communication Security

5 source controls mapped|4 target controls covered

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements

5 source controls mapped|2 target controls covered

UK Gambling Commission LCCP and Remote Technical Standards

5 source controls mapped|2 target controls covered

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

5 source controls mapped|6 target controls covered

BSI IT-Grundschutz

5 source controls mapped|7 target controls covered

TSA Pipeline Cybersecurity Directives

5 source controls mapped|1 target controls covered

South Korea PIPA

5 source controls mapped|3 target controls covered

Virginia CDPA

5 source controls mapped|2 target controls covered

Vietnam PDPD

5 source controls mapped|1 target controls covered

Uruguay DPL

5 source controls mapped|2 target controls covered

Texas Data Privacy and Security Act (TDPSA)

5 source controls mapped|1 target controls covered

Taiwan PDPA

5 source controls mapped|2 target controls covered

Qatar DPL

5 source controls mapped|2 target controls covered

POPIA

5 source controls mapped|1 target controls covered

Peru DPL

5 source controls mapped|3 target controls covered

PDPA Thailand

5 source controls mapped|2 target controls covered

PDPA Singapore

5 source controls mapped|2 target controls covered

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

5 source controls mapped|4 target controls covered

APPI

5 source controls mapped|4 target controls covered

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management

5 source controls mapped|5 target controls covered

Bahrain PDPL

5 source controls mapped|4 target controls covered

Saudi Arabia PDPL

5 source controls mapped|4 target controls covered

SANS Incident Handler's Handbook and PICERL Methodology

5 source controls mapped|7 target controls covered

AICPA Privacy Management Framework (PMF)

5 source controls mapped|4 target controls covered

PIC/S Guide to Good Manufacturing Practice for Medicinal Products

4 source controls mapped|4 target controls covered

ICH Q10 - Pharmaceutical Quality System

4 source controls mapped|3 target controls covered

AS9100D - Aerospace Quality Management System

4 source controls mapped|1 target controls covered

Kuwait National Cybersecurity Framework

4 source controls mapped|2 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

4 source controls mapped|6 target controls covered

ISO 20400:2017 - Sustainable Procurement

4 source controls mapped|3 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety

4 source controls mapped|4 target controls covered

ISO/IEC 23894:2023

4 source controls mapped|6 target controls covered

IAIS Insurance Core Principles (ICPs)

4 source controls mapped|3 target controls covered

ISO/IEC 27003:2017

4 source controls mapped|2 target controls covered

COBIT 2019

4 source controls mapped|2 target controls covered

ISO/IEC 27007:2020

4 source controls mapped|2 target controls covered

ISO/IEC 25012:2008 - Data Quality Model

4 source controls mapped|3 target controls covered

ISO/IEC 27031:2011

4 source controls mapped|8 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

4 source controls mapped|4 target controls covered

Canada ITSG-33 - IT Security Risk Management

4 source controls mapped|1 target controls covered

FedRAMP Rev 5

4 source controls mapped|7 target controls covered

SLSA

4 source controls mapped|3 target controls covered

SIG (Shared Assessments)

4 source controls mapped|3 target controls covered

PTES

4 source controls mapped|4 target controls covered

OWASP SAMM

4 source controls mapped|3 target controls covered

ISO/IEC 27043:2015

4 source controls mapped|7 target controls covered

ISO/IEC 27011:2024

4 source controls mapped|6 target controls covered

ISO/SAE 21434

4 source controls mapped|7 target controls covered

UK GDPR (UK General Data Protection Regulation)

4 source controls mapped|2 target controls covered

Trinidad and Tobago Data Protection Act 2011

4 source controls mapped|3 target controls covered

Tanzania Personal Data Protection Act 2022

4 source controls mapped|2 target controls covered

ISO/IEC 30111:2019

4 source controls mapped|3 target controls covered

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

4 source controls mapped|3 target controls covered

Barbados Data Protection Act 2019

4 source controls mapped|2 target controls covered

UK Telecommunications (Security) Act 2021

4 source controls mapped|2 target controls covered

ISO 37001:2016

3 source controls mapped|3 target controls covered

SEC Climate Disclosure Rule

3 source controls mapped|1 target controls covered

ICAO Annex 17 - Aviation Security (AVSEC)

3 source controls mapped|1 target controls covered

AML/CTF Act 2006 (Australia)

3 source controls mapped|1 target controls covered

Singapore AI Governance Framework

3 source controls mapped|1 target controls covered

Authorised Economic Operator (AEO) Programmes - Global Standards

3 source controls mapped|1 target controls covered

UAE Virtual Asset Regulatory Authority (VARA) Regulations

3 source controls mapped|1 target controls covered

Aged Care Quality Standards 2019 (repealed edition)

3 source controls mapped|1 target controls covered

APRA SPS 220 Risk Management (Superannuation)

3 source controls mapped|1 target controls covered

Solvency II

3 source controls mapped|3 target controls covered

UK FCA/PRA Operational Resilience Framework

3 source controls mapped|1 target controls covered

ITU-T X.805 - Security Architecture for End-to-End Communications

3 source controls mapped|1 target controls covered

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements

3 source controls mapped|1 target controls covered

UK Security and Emergency Measures Direction (SEMD) - Water Industry

3 source controls mapped|2 target controls covered

Secure by Design: A Guide for Manufacturers (CISA)

3 source controls mapped|3 target controls covered

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

3 source controls mapped|6 target controls covered

Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)

3 source controls mapped|1 target controls covered

Nevada Gaming Control Board Cybersecurity Requirements

3 source controls mapped|1 target controls covered

COSO Internal Control - Integrated Framework (2013)

3 source controls mapped|1 target controls covered

ISO 26262:2018 - Functional Safety for Road Vehicles

2 source controls mapped|2 target controls covered

Automotive SPICE (ASPICE) v4.1 - Process Assessment Model

2 source controls mapped|3 target controls covered

ISO/TS 22317:2021

2 source controls mapped|5 target controls covered

ISO 22316

2 source controls mapped|5 target controls covered

ISO 22313:2020 - Guidance on Business Continuity Management Systems

2 source controls mapped|3 target controls covered

ISO/TS 22318:2021

2 source controls mapped|5 target controls covered

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)

2 source controls mapped|2 target controls covered

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework

2 source controls mapped|2 target controls covered

ISO/IEC 23837:2023

2 source controls mapped|4 target controls covered

ISO 22301:2019

1 source controls mapped|1 target controls covered

ISO 55001:2014

1 source controls mapped|1 target controls covered

ISO 37301:2021

1 source controls mapped|1 target controls covered

ISO 50001:2018 - Energy Management Systems

1 source controls mapped|1 target controls covered

ISO 27701:2019

1 source controls mapped|1 target controls covered

ISO 9001:2015

1 source controls mapped|1 target controls covered

ISO 13485:2016

1 source controls mapped|1 target controls covered

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties

1 source controls mapped|1 target controls covered

WCAG 2.2

1 source controls mapped|1 target controls covered

Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter

1 source controls mapped|1 target controls covered

UK Bribery Act 2010

1 source controls mapped|3 target controls covered

Philippines Cybercrime Prevention Act (RA 10175)

1 source controls mapped|1 target controls covered

French Sapin II Law (Law No. 2016-1691)

1 source controls mapped|1 target controls covered

Florida Digital Bill of Rights (FDBR)

1 source controls mapped|2 target controls covered

Illinois Biometric Information Privacy Act (BIPA)

1 source controls mapped|1 target controls covered

ISO/IEC 29134:2023

1 source controls mapped|1 target controls covered

ISO 8000 - Data Quality

1 source controls mapped|2 target controls covered

ISO/IEC 29147:2018

1 source controls mapped|2 target controls covered

ISO/IEC 27014:2020

1 source controls mapped|2 target controls covered

ISO 41001:2018 - Facility Management Systems

1 source controls mapped|2 target controls covered

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)

1 source controls mapped|2 target controls covered

Connecticut Data Privacy Act (CTDPA)

1 source controls mapped|1 target controls covered

US Foreign Corrupt Practices Act (FCPA)

1 source controls mapped|1 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration

1 source controls mapped|2 target controls covered

Science Based Targets Initiative (SBTi) - Net-Zero Standard

1 source controls mapped|2 target controls covered

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM)

1 source controls mapped|3 target controls covered

Azerbaijan Law on Personal Data (2010)

1 source controls mapped|1 target controls covered

ISO/IEC 27004:2016

1 source controls mapped|3 target controls covered

Albania Law No. 124/2024 on Personal Data Protection

1 source controls mapped|2 target controls covered

ISO/IEC 27050-1:2019

1 source controls mapped|1 target controls covered

PCI DSS 4.0

1 source controls mapped|1 target controls covered

Nebraska Data Privacy Act

1 source controls mapped|2 target controls covered

ISO/IEC 29100:2024

1 source controls mapped|3 target controls covered

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)

1 source controls mapped|1 target controls covered

ISO 56002

1 source controls mapped|2 target controls covered

DFARS 252.204-7012 - Safeguarding Covered Defense Information

1 source controls mapped|1 target controls covered

FedRAMP High

1 source controls mapped|1 target controls covered

FedRAMP Moderate

1 source controls mapped|1 target controls covered

Singapore Cybersecurity Act 2018

1 source controls mapped|1 target controls covered

Sweden Data Protection Act (Dataskyddslag, 2018:218)

1 source controls mapped|1 target controls covered

US SEC Digital Assets and Crypto Regulatory Framework

1 source controls mapped|2 target controls covered

WHO Global Strategy on Digital Health 2020-2025

1 source controls mapped|1 target controls covered

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

1 source controls mapped|1 target controls covered

Sigstore - Software Artifact Signing and Verification

1 source controls mapped|2 target controls covered

FIDO2 / WebAuthn

1 source controls mapped|1 target controls covered

ISO 27799:2025

1 source controls mapped|2 target controls covered

NSA Guidance for Transition to Quantum-Resistant Cryptography

1 source controls mapped|3 target controls covered

US ITAR and EAR - Export Control and Data Security

1 source controls mapped|2 target controls covered

W3C Verifiable Credentials (VC) Data Model 2.0

1 source controls mapped|1 target controls covered

3GPP 5G Security Architecture (TS 33.501)

1 source controls mapped|2 target controls covered

Compare PCI P2PE with PSD2 SCA

Coverage is not the same as your position

This page shows what PCI P2PE overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is PCI P2PE and who does it apply to?

PCI P2PE is a compliance framework from Global (PCI Security Standards Council; P2PE solution providers, component providers, application vendors and merchants operating merchant-managed solutions) with 6 domains and 295 controls. The PCI Point-to-Point Encryption Security Requirements and Testing Procedures (PCI Security Standards Council, v3.1, September 2021) set what a P2PE solution must meet for account data to be encrypted in a PCI-approved POI device with SRED and decrypted only in a secured decryption environment, reducing the merchant's PCI DSS scope: Domain 1 encryption device and application management, Domain 2 application security, Domain 3 solution management, Domain 4 the decryption environment, Domain 5 cryptographic key operations and device management (restated from PCI PIN), and Appendix A merchant-managed solutions. The graph models the 295 sub-requirements. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does PCI P2PE actually require?

PCI P2PE has 295 controls organised across 6 domains. The largest domains are Domain 5: P2PE Cryptographic Key Operations and Device Management – PCI P2PE (137 controls), Domain 4: Decryption Environment – PCI P2PE (68 controls), Domain 2: Application Security – PCI P2PE (37 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of PCI P2PE do I already cover?

PCI P2PE maps to 177 other compliance frameworks. The top mapping partners are PSD2 SCA (4% coverage), FFIEC IT Examination Handbook (4% coverage), PCI SSF (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement PCI P2PE?

Start your PCI P2PE compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about PCI P2PE requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 295 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.

Get Started Free →

Free forever, no credit card required