Are POI devices with only PTS-approved firmware (i.e., no additional software) eligible for use in a PCI P2PE solution?
Yes. However, while it may be possible for a PCI POI device to implement all the necessary functionality for use in a P2PE solution solely within its existing PTS-approved firmware, generally the POI device will contain additional software. Any software (whether it has access to cardholder data or not) that is present or intended to be present on the POI device within the P2PE solution that was not included in the PTS-evaluation and approval of the POI device's firmware must be assessed in accordance with the PCI P2PE Standard. Note that it may be possible for additional (non-firmware) software to be present on the POI device during its PTS assessment. However, any software that does not meet the PTS POI definition of firmware is not reviewed as part of the PTS POI assessment or included in the PTS approval. The assessor must be diligent in identifying any non-firmware on the POI device(s). If the POI device contains ANY software that was not included in the POI device's PTS-approved firmware, then that software MUST be assessed to the applicable PCI P2PE requirements. See also FAQ 1338 entitled What is the difference between POI firmware and additional software that may be present on the POI device?.