Diff: FAQ #1339

Are POI devices with only the PTS-approved firmware (i.e., no additional software) eligible for use in a PCI P2PE solution?

Earlier Version
Later Version
Removed
Added
Yes. However, while it may be possible for a PCI POI device to implement all the necessary functionality for use in a P2PE solution solely within its existing PTS-approved firmware, generally the POI device will contain additional software. Any software (whether it has access to cardholder data or not) that is present or intended to be present on the POI device within the P2PE solution that was not included in the PTS-approvalPTS-evaluation and approval of the POI’sPOI device's firmware must be assessed in accordance with the PCI P2PE standard.Standard. Note that it may be possible for additional (non-firmware) software to be present on the POI terminaldevice during its PTS assessment. However, any software that does not meet the PTS POI definition of firmware is not reviewed as part of the PTS POI assessment or included in the PTS approval. The assessor must be diligent in identifying any non-firmware on the POI device(s). If the POI device contains ANY software that was not included in the POI device?sdevice's PTS-approved firmware, then that software MUST be assessed to the applicable PCI P2PE requirements. See also FAQ entitledWhat1338 entitled What is the difference between POI firmware and additional software that may be present on the POI device?.

Disclaimer: This FAQ has been processed for display on this website and may contain errors. Please check the original FAQ on the PCI SSC website for the authoritative version.