Evan Schuman's StorefrontBacktalk

Once a PTS lab approves a P2PE device, the merchant should have some level of assurance that its device can (I did not say “will”) protect cardholder data. The QSA’s role is to determine whether the device is properly configured so that the merchant cannot access any PAN or magstripe data.

P2PE vendors and manufacturers will submit their devices to a PTS lab just like they do their PIN pads today. The PCI Council will (presumably) list all approved devices, and merchants can check that list before they sign on the dotted line. The issue for early adopters is, what do they do if their devices are not on the approved list?

From this QSA’s perspective, about the only thing merchants can do today is to check their contract to see if there is any provision that covers this eventuality. For example, if the vendor has other devices that are approved, can the merchant trade in its unapproved devices and get some discount? Similarly, if a merchant’s device appears in a Visa security bulletin, is there some price break (say, based on age of device) on replacements? Unfortunately, if the vendor has no approved device options, the merchant could be out of luck.

Merchants may want to recognize this situation and include some provision in their vendor agreements. My guess is that most experienced vendors’ P2PE devices will pass the Council’s testing regime. The terminal manufacturers are smart people, many make PTS-approved devices already, and everybody has to have anticipated something like this. But just in case, merchants may want to consider a provision in their contract or service-level agreement should their vendor’s promise to reduce PCI scope not be realized.

It also is interesting to note the Council’s expected testing and approval regime will apply to almost any POS device that reads and encrypts cardholder data. That means this Secure Card Reader designation will cover peripherals attached to a mobile device that encrypt the data and then pass only that encrypted data to the mobile smart device for transmission and processing. My guess is that including these peripheral devices in the Secure Card Reader class may be what the Council referred to in its Mobile Payments announcement this past June.

Like merchants, vendors and QSAs everywhere, I am anxiously awaiting details from the PCI Council on P2PE implementation guidelines. It has been two years since the Council’s first study identifying P2PE as a promising technology for reducing PCI scope and speeding compliance.

What do you think? Have you implemented P2PE? Are you looking at it? I’d like to hear your thoughts. Either leave a comment or E-mail me at wconway@403labs.com.