PCI Certification

This lesson covers four PCI programmes: PTS HSM, PIN Security, P2PE and key management operations. It does not cover PTS POI, card production and provisioning, 3-D Secure, or MPoC and CPoC.

PCI has two very different kinds of evidence, and most mistakes about payment HSMs come from mixing them up. Device approval says a product model was designed and evaluated to PCI’s device requirements. Entity assessment says an organisation runs its payment operations — PIN processing, encryption, key management — to PCI’s operational requirements. This section is about the first: PCI PIN Transaction Security (PTS) Hardware Security Module (HSM) approval.

Everything PCI-specific in this lesson comes from public PCI SSC pages, which are cited next to each statement. Where a sentence is this module’s own reading or advice, it says so. Documents in the PCI Document Library are named by title and date only; their content is not used here.

What the approval covers

PCI SSC describes the PTS HSM standard as providing guidance for designing HSMs to meet the security needs of the financial payments industry, “and for protecting those HSMs up to the point of initial deployment. Other security requirements apply at the point of deployment for the management of HSMs involved with the financial payments industry.” [PCI SSC, PTS Hardware Security Module (HSM) — standard page, read 30 October 2026]

That sentence sets the boundary. An approval tells you about:

• a device model, at the hardware and firmware versions named on its listing;
• evaluated against one major version of the PTS HSM requirements (v3.x, v4.x, v5.x);
• by an independent PCI-recognized laboratory: “Independent PCI-Recognized Laboratories evaluate HSMs against PTS HSM security requirements. PCI SSC reviews evaluation reports, approves PTS HSM devices, and provides a listing of approved devices.” [PCI SSC, PTS Hardware Security Module (HSM) — standard page, read 30 October 2026]

This module reads the page’s “other security requirements” at deployment as entity questions — how a bank, processor or cloud operator installs, administers or keys the device — answered by PIN, P2PE or KMO assessments (the boundary lesson below). That mapping is the module’s own reading. PCI says who must validate, or use a listed product, is not its call: “Compliance programs for all PCI SSC standards are managed by the payment brands.” [PCI SSC, PTS Hardware Security Module (HSM) — standard page, read 30 October 2026]

Versions are part of the claim

The listing’s field definitions say: “Version refers to the version of the security requirements the device has been evaluated against. Each approval class may follow its own version release schedule.” They also say: “Approval numbers are assigned by PCI SSC at the time of approval and remain the same for the life of the device’s approval.” [PTS listing field definitions] So read a listing as a pair: the approval number and the requirements version behind it. This module’s own advice, not a PCI requirement: when you rely on a listed device, compare the vendor, model, hardware and firmware versions and the approval number you deploy with the listing.

PCI’s Device Testing and Approval Program Guide is listed in the Document Library on 18 May 2026; the feed gives its title and date and no version number. [PCI SSC, PCI SSC Document Library (titles and publication dates only), read 30 October 2026] Its content is not used in this module.

Restricted or unrestricted

An HSM approval can be restricted: “Approval is valid only when deployed in an environment meeting at least the security requirements of a Controlled Environment as defined in the Key Management Operations Security and Test Requirements and in the device’s PCI HSM Security Policy.” Unrestricted approval “is valid in any operational environment.” The listing states which, under Additional Information. [PTS listing field definitions]as of 30 October 2026 Two real listings, read on 30 October 2026, show both: payShield 10K (4-40266) reads “Approved usage: Restricted” [PCI SSC, Approved PTS Devices listing 4-40266 (payShield 10K), read 30 October 2026] and Atalla HSM AT1000 (4-70041) reads “Approved usage: Unrestricted” [PCI SSC, Approved PTS Devices listing 4-70041 (Atalla HSM AT1000), read 30 October 2026]. This module’s reading: a restricted approval moves a question to the deployment, to be answered where the device is installed.

The clocks

These are scheme clocks — what PCI’s device programme is doing. They are not market PQC deadlines, which this module never types into prose. The dates in the listing’s expiry table say when device approvals expire; no PCI page used here ties them to quantum. as of 30 October 2026

• 1 Jan 2026

  P2PE: from this date all new P2PE submissions, including reassessments, must comply with P2PE v3.2 (announced 30 June 2025 as a minor revision). Validations already done to P2PE v3.0 or v3.1 are not affected by the release of v3.2.

  [PCI SSC, PCI SSC Releases Version 3.2 of the PCI Point-to-Point Encryption (P2PE) Standard (PCI Perspectives blog), 30 June 2025]

• 18 May 2026

  PCI SSC published the PTS HSM Modular Security Requirements v5.0, a major revision from v4.0. The v5.0 announcement says the Document Library lists the v5.0 Modular Security Requirements, the v5.0 Modular Derived Test Requirements and the PCI PTS Device Testing and Approval Program Guide (no version number given).

  [source]

• Listing table

  The listing’s expiry table gives, per HSM requirements version, when the requirements approval and the device models expire: v5.x May 2030 and April 2036; v4.x June 2027 and April 2033; v3.x December 2022 and April 2028. Device approvals "expire six years past the effective date of a subsequent major … update" of the Security Requirements. These are approval expiry dates, not post-quantum deadlines.

  [source]

• 14 Sep 2026

  PCI Key Management and Operations (KMO) Standard v1.0 published. The Document Library lists the Key Management and Operations Standard and the KMO Program Guide on 14 September 2026 and the KMO Assessor Qualification Requirements on 21 September 2026 (titles and dates only).

  [source]

Read the expiry table the way a vendor would. For HSMs it gives v4.x: requirements approval June 2027, device models April 2033; and v5.x: May 2030 and April 2036 (the columns are “Expiration of Requirements Approval” and “Expiration of Device Models”). [PTS listing field definitions] Applied to Orrin N7 (fictional): a device evaluated under v4.x would carry a device-model expiry of April 2033, and one under v5.x April 2036. The v5.0 announcement states no separate effective date, so do not invent one — the dates in the table above are the ones the pages used here give.