This is page 2 of:
New PCI P2PE Rules Drop Compliance Requirements To 2
In another parallel with PA-DSS, P2PE has two new categories of specialized QSAs: P2PE QSAs, companies and individuals who evaluate point-to-point encryption solutions; and P2PE PA-QSAs, companies and individuals who evaluate applications on PCI-approved Point of Interaction (POI) devices for point-to-point encryption solutions. Not all QSA companies will be P2PE QSAs or P2PE PA-QSAs. (I may have just set a record for the most acronyms in a single paragraph.)
This will not happen quickly. As highlighted previously, although the Council announced the validation requirements, we will not see the actual testing procedures until the end of the year. We also only have the validation requirements for using secure hardware devices for encryption and decryption (so called “hardware/hardware” approaches). Requirements for packages using software decryption within hardware (“hardware/software”) should come out by the end of the year, too. It also will take time for vendors to get their hardware devices through the testing process. Lastly, QSA training will not be available until the spring of 2012, about six months or so from now.
Retailers must coordinate their P2PE decisions with their acquirers. Other than the four pages of that appendix, this document is aimed at the vendor community. There is a section on Roles and Responsibilities, though, and it identifies how merchants can reduce their PCI scope using P2PE. The first step is some good advice: “Coordinating with the acquirer (merchant bank) to determine which payment device (as part of a validated P2PE solution) the merchant should implement.”
Following the Council’s advice is smart. The PCI Council site will list validated hardware and software. You do not want to spend money and time on a vendor package that does not meet the validation requirements or that causes your acquirer to challenge your reduced PCI scope.
If you have a P2PE system in place, monitor your vendor’s validation progress. I raised this issue for early adopters before, and the advice stands.
-Marc
September 22nd, 2011 at 9:48 am
Thank you PCI SSC for finally publishing this guidance. Perhaps we’ll now see some larger merchants take a real look at the value proposition of P2PE, since they can build a scope reduction ROI model. Two problems remain. First, the two viable P2PE solutions on the market do not meet the requirements of this guidance. They use format preserving encryption and not a required ISO or ANSI standard one. This was brought up in a Community Meeting QA session where the panel left the door open to FPE in future updates. Second, given Visa’s recent Chip/NFC announcement, I expect most merchants will want their strategy to incorporate that before making big investments.
The ideal solution for merchants in the US, given what’s available today, would be one that combines P2PE and Chip. Merchants are then protected from losing card data and from accepting fraudlent cards.
Unfortunately, we have to wait longer for this to sort out.
September 28th, 2011 at 8:36 pm
No fear Ernie – FFX mode AES is in the standards process – aka Format Preserving Encryption. NIST has already announced intent to move to a standard back in June – check the NIST website for the specifics.