What is the scope of the PCI CP & PLS requirements?
PCI CP & PLS (Card Production and Personalisation / Logical Security) requirements apply to every logical security activity involved in card production and provisioning. Specifically, they cover both traditional on-premises environments and modern cloud-based provisioning systems. Moreover, any organization that handles cryptographic keys or provisioning data falls within scope, even if it does not manufacture physical cards.
In practice, PCI CP PLS scope covers six activity categories:
- Data preparation and card personalization
- Pre-personalization, PIN generation, and PIN mailers
- Card carriers and distribution workflows
- Cloud provisioning and Secure Element (SE) provisioning
- Over-the-Air (OTA) provisioning
- Full lifecycle management of cryptographic keys
How does PCI CP PLS classify and protect sensitive data?
The standard defines two categories of sensitive data. First, Secret Data covers assets whose disclosure would cause major operational or financial harm. Specifically, this includes symmetric keys, private asymmetric keys (except those used only for cardholder-data encryption), PIN keys, and PINs. Second, Confidential Data covers information whose compromise would create business or legal exposure, such as PAN, expiration date, service code, and encryption keys used to protect cardholder data.
In practice, PCI CP PLS enforces four data protection rules across both categories:
- Encrypt all data during transmission and storage at all times
- Use algorithms and key sizes aligned with Normative Annex A
- Decrypt data only for the minimal operational time required
- Never decrypt cardholder data on Internet-facing or public networks
What are the key network segregation requirements under PCI CP PLS?
PCI CP PLS mandates strict segmentation to prevent unauthorized lateral movement and exposure of sensitive systems. Specifically, personalization and data-preparation systems must run on dedicated networks that are completely isolated from back-office or Internet-connected networks. Moreover, a VLAN alone does not provide adequate separation. As a result, organizations must implement physical and logical boundaries that go beyond software-level controls.
In practice, the standard requires four specific architecture controls:
- A dedicated Card Production and Provisioning DMZ through which all traffic entering or leaving the personalization network must route
- Physically separate firewalls between the external network and the DMZ
- Physically separate firewalls between the DMZ and the cloud-based provisioning network
- A fully separate, segmented environment for Host Card Emulation (HCE) provisioning
What principles govern cryptographic key management under PCI CP PLS?
PCI CP PLS enforces two foundational security principles for all key lifecycle operations. Specifically, split knowledge ensures that no single key component reveals anything about the complete key. Furthermore, dual control requires at least two individuals to act together for any sensitive operation, so no individual can access, reconstruct, or use an entire key alone.
In addition, the standard sets strict requirements for secure key creation. Specifically, key generation must take place inside a Hardware Security Module (HSM). Moreover, the HSM must hold PCI approval or certification at FIPS 140-2 or 140-3 Level 3 or higher. As a result, software-based key generation is not acceptable for any PCI CP PLS-scoped operation.
What controls apply to user management, access control, and authentication?
Access must follow the principle of least privilege, limiting each individual to what their business role genuinely requires. Specifically, each account must tie to a unique user ID to guarantee accountability and traceability. In fact, shared accounts are not permitted because they break the audit trail that the standard requires for all sensitive operations.
In practice, authentication controls cover three areas:
- Administrative access: mandatory multi-factor authentication (MFA) for all administrative sessions
- Remote access: mandatory MFA for any remote connection into the card production or provisioning environment
- Password rules: at least 12 characters (or equivalent strength for 8-character passwords), with a maximum password lifetime of 90 days
