1

If my Hardware device is on the PCI list from here https://www.pcisecuritystandards.org/approved_companies_providers/approved_pin_transaction_security.php

Does my POS need to be PCI compliant since the POS cannot unencrypt the data since it is a point to point approved PCI encrypted solution? The Encrypted Point to Point solution sends the card data to the gateway and the POS receives back just the token information.

user41386
  • 11
  • 2

1 Answers1

1

On the PCI Security Standards website you referenced you can find this video which summarises Point To Point Encryption (P2PE) for small businesses (assuming you are a small business).

The gist of the video is that because P2PE encrypts the sensitive card data and you as a merchant don't have access to it, your systems are excluded from card data protection requirements during a PCI-DSS audit. Rather, the onus on protecting specifically the card holder data shifts to the P2PE service provider. It is up to the service provider to obtain their own certification of the P2PE solution they provide to you. Ostensibly, this abstracts away the cost and effort of protecting the data if you are a merchant.

It's tempting to think that this absolves you from PCI-DSS compliance but the video does finish with the warning that you as a merchant are still bound by PCI-DSS. This is because PCI-DSS is about more than protecting just the sensitive card data. You also need to protect the environment in which the transaction takes place. For example, you are probably going to fail a PCI-DSS audit if you don't use passwords on your POS systems because then anyone could come along and subvert the P2PE solution. Or open unsecured network connections. Or simply just break the P2PE implementation to deny legitimate transactions (a DoS attack which also contravenes PCI-DSS).

Having a P2PE solution implemented on your POS means you as a merchant are more likely to be certified as PCI-DSS compliant because you are then exempt from protecting card holder data. But PCI-DSS isn't about just protecting the data, it's about protecting the transaction itself and all parties in the transaction.

user3337410
  • 103
  • 1
  • 7