Payment Card Industry PTS POI Derived Test Requirements, v5.1 March 2018
© Copyright 2010-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page v
DTR E3.3 PIN Entry Interface Segregation ................................................................................................ 97
DTR E3.4 User Interface Consistency ........................................................................................................ 98
DTR E3.5 Control of any Numeric Interface ............................................................................................. 100
DTR E4.1 Protection against Removal ..................................................................................................... 101
DTR E4.2 Unauthorized Removal – Integration Documentation .............................................................. 103
DTR E4.3 Unauthorized Removal – Embedded Devices .......................................................................... 104
DTR Module 3: Open Protocols Requirements .................................................................................... 105
F – Discovery and Definition of Protocols and Interfaces .................................................................. 105
DTR F1 Identification of Interfaces ........................................................................................................ 105
DTR G1 Vendor Vulnerability Assessment Procedures ......................................................................... 107
DTR G2 Vulnerability Assessment of all Interfaces ................................................................................ 108
DTR G3 Vulnerability Disclosure............................................................................................................ 109
H – Vendor Guidance .............................................................................................................................. 110
DTR H1 Security Guidance for the Protocols and Interfaces ................................................................. 110
DTR H2 Default Configuration of the Interfaces..................................................................................... 111
DTR H3 Key Management Security Guidance....................................................................................... 112
I – Operational Testing ............................................................................................................................ 113
DTR I1 Use of Secure Protocols .......................................................................................................... 113
DTR I2 Secure Protocols to Provide Data Confidentiality .................................................................... 114
DTR I3 Secure Protocols to Provide Data Integrity .............................................................................. 115
DTR I5 Secure Protocols to Provide Exception Handling and Replay Detection ................................. 117
DTR I6 Session Management .............................................................................................................. 118
Evaluation Module (Core): Configuration and Maintenance Security ............................................ 119
J – Configuration and Maintenance Security ....................................................................................... 119
DTR J1 Security Guidance for Configuration Management .................................................................. 119
DTR J2 Security Maintenance .............................................................................................................. 120
DTR J3 Security Guidance for Terminal Updates ................................................................................. 121
DTR J4 Securing Configuration and Software Updates ........................................................................ 122
DTR Module 4: Secure Reading and Exchange of Data ...................................................................... 123
K – Account Data Protection Derived Test Requirements .................................................................. 123
DTR K1 Account Data Processing ......................................................................................................... 123
DTR K1.1 Account Data Protection .......................................................................................................... 124
DTR K2 Account Data Protection – Integration...................................................................................... 126
DTR K3 Determining Keys Analysis ...................................................................................................... 127
DTR K3.1 Public Key Protection ............................................................................................................... 130
DTR K4 Encryption Mechanisms ........................................................................................................... 131
DTR K5 Remote Key Distribution .......................................................................................................... 133
DTR K6 Data Origin Authentication ....................................................................................................... 134
DTR K7 Unique Secret and Private Keys Per Device ............................................................................ 135
DTR K8 Encryption/Decryption of Arbitrary Data Within a Device ......................................................... 136
DTR K9 Remote Access ........................................................................................................................ 138
DTR K10 Firmware Certification .............................................................................................................. 139
DTR K11.1 Software Authenticity ............................................................................................................... 142
DTR K11.2 Software Guidance .................................................................................................................. 144
DTR K12 Firmware Updates ................................................................................................................... 145
DTR K13 Logical Anomalies .................................................................................................................... 148
DTR K14 Open Protocols and Services .................................................................................................. 151
DTR K15 Output of Clear-text Account Data ........................................................................................... 152
DTR K15.1 Protection of Clear-text Data .................................................................................................... 154
DTR K15.2 Clearing of Internal Buffers ...................................................................................................... 155
DTR K16 Surrogate PAN Values ............................................................................................................. 157
DTR K16.1 Salt Generation ........................................................................................................................ 158
DTR K16.2 Salt Storage ............................................................................................................................. 159
