PCI P2PE
The PCI Point-to-Point Encryption (P2PE) standard defines how a solution provider must design and operate a payment terminal encryption solution so that cardholder data is encrypted inside a PTS-approved device and cannot be decrypted until it reaches a secure decryption environment.
Solutions that meet the standard are validated by a P2PE assessor and listed by PCI SSC; merchants that use a listed solution exactly as described in its P2PE Instruction Manual (PIM) can reduce their own PCI DSS scope and qualify for SAQ P2PE.
The standard is organized into domains covering encryption devices, application security, decryption environment, key management, and the solution provider's management of the whole chain. The version in current use is v3.x (v3.1 appears on current attestations).
In writing, a solution provider must keep a complete inventory of devices and key custodians, documented key management procedures, a decryption environment security policy, chain of custody and device handling procedures, the PIM for merchants, and the P2PE Report on Validation with an Attestation of Validation.
Component providers (for example key injection facilities or decryption service providers) can be validated separately and listed as P2PE components.
help
Who has to comply
Voluntary for solution providers, but required if they want their solution listed as PCI-validated P2PE. Merchants are not assessed against P2PE; they benefit from using a listed solution and completing SAQ P2PE where their acquirer allows.
What the assessor asks to see
Solution architecture and data flows; device inventory with PTS approval numbers; device handling, shipping and chain of custody procedures; key management policies, key ceremonies and custodian records; decryption environment security controls and PCI DSS evidence; application assessment evidence for any P2PE application; the P2PE Instruction Manual; component provider validations; prior P2PE ROV and AOV.
Who helps with PCI P2PE
A specialized ecosystem: P2PE assessor companies offer readiness services, and key management and HSM consultants help design decryption environments. Engagements typically take several months because device, application and key management domains are all in scope.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Consultants
Be the first PCI P2PE consultant listed here
The people reading this are working out who can help them get there.
Who assesses PCI P2PE
A PCI SSC qualified P2PE Assessor company (a QSA company additionally qualified for P2PE) with qualified P2PE assessor employees, producing the P2PE Report on Validation. Accredited by PCI Security Standards Council qualification.
Public register of assessors: pcisecuritystandards.org ↗
Assessors
Be the first PCI P2PE assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for PCI P2PE
Tools that name this framework in their own material.
Tools
Be the first tool listed for PCI P2PE
Buyers comparing software for this standard land here first.
Related reading
- What's in scope for your P2PE solutions assessment?A P2PE assessor explains the five domains, what falls inside a solution's scope and what the P-ROV has to cover.Schellman
- PCI P2PE vs E2EE: scoping it outExplains why only a listed P2PE solution reduces merchant scope, and what plain end-to-end encryption does not buy you.TrustedSec
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for PCI P2PE
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with PCI P2PE
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.