PCI 30 Seconds Newsletter #41 - Is the use of PCI PTS-approved devices required for PCI DSS Compliance?

What is meant by PTS-approved devices?

PTS is the acronym for “PIN Transaction Security,” a set of modular evaluation requirements managed by PCI Security Standards Council that focuses on protecting POI (Point-Of-Interaction) devices.

POI is used here as a generic term for card present payment devices (hardware & software). It covers ATM's and POS (Point-Of-Sale) devices whether they be attended, i.e. manned by merchants, or unattended (UPT), i.e. parking payment automated machines.

PTS-approved terminals actually means card payment devices or terminals complying with the PCI PTS requirements.

Could the use of non PTS-approved devices jeopardize your PCI DSS compliance? 

Here is the answer:


According to PCIco  (FAQ)

"While use of PTS-approved payment devices can facilitate PCI DSS compliance, such devices do not by themselves guarantee PCI DSS compliance or reduce the scope of a merchant’s cardholder data environment. The boundaries of the cardholder data environment are not affected by the presence or absence of a PTS-approved terminal, and any terminal interactions with the merchant’s environment are in scope for a merchant’s PCI DSS implementation.   PTS approved devices must be reviewed during a PCI DSS assessment to confirm that they are configured properly and that the security functions and settings have not been disabled.  For example, the assessor would verify that the terminal has not been configured by the merchant to store sensitive authentication data after authorization or to transmit clear-text account data over the Internet.

It should be noted that while PCI DSS does not require the use of PTS-approved devices, some payment brands have requirements for the use of PTS-approved devices. Entities should contact their acquirer or the payment brands directly for information about any such requirements."

Is this valid in all cases?
 
According to Jeremy King: the answer is no. It depends which country the merchant is based in. If they are in a EMV based country then the brands demand PCI PTS terminals for DSS Compliance. If it is a non EMV based country then they do not use PTS approved terminals and are not subjected to the above requirement. 

EMV stands for “Europay, MasterCard, and Visa”  and consists of a technical standard for smart payment card, terminals and ATM's that can accept them. EMV cards are smart cards (also called chip cards or IC cards) which store their data on integrated circuits rather than  magnetic stripes, although many EMV cards also have magnetic stripes for backward compatibility.

To conclude: 
The use of PTS approved devices is required for PCI DSS compliance ONLY for EMV based country. Check the EMVco Website (here under) for a glimpse on the EMV deployment regions and rates  

Links

• Ready to use PCI Procedures & Templates
• PCI DSS V3.1 Compliance Dashboard
•  EBook: PCI, That’s the Way It Is.
• PCI PIN Transaction Security Requirements
• EMVco deployment data