Framework Information Security & Privacy
The PCI Point-to-Point Encryption (P2PE) standard defines how a solution provider must design and operate a payment terminal encryption solution so that cardholder data is encrypted inside a PTS-approved device and cannot be decrypted until it reaches a secure decryption environment.
Solutions that meet the standard are validated by a P2PE assessor and listed by PCI SSC; merchants that use a listed solution exactly as described in its P2PE Instruction Manual (PIM) can reduce their own PCI DSS scope and qualify for SAQ P2PE.
The standard is organized into domains covering encryption devices, application security, decryption environment, key management, and the solution provider's management of the whole chain. The version in current use is v3.x (v3.1 appears on current attestations); verify the exact version in the PCI SSC document library.
In writing, a solution provider must keep a complete inventory of devices and key custodians, documented key management procedures, a decryption environment security policy, chain of custody and device handling procedures, the PIM for merchants, and the P2PE Report on Validation with an Attestation of Validation.
Component providers (for example key injection facilities or decryption service providers) can be validated separately and listed as P2PE components.
Voluntary for solution providers, but required if they want their solution listed as PCI-validated P2PE. Merchants are not assessed against P2PE; they benefit from using a listed solution and completing SAQ P2PE where their acquirer allows.
Solution architecture and data flows; device inventory with PTS approval numbers; device handling, shipping and chain of custody procedures; key management policies, key ceremonies and custodian records; decryption environment security controls and PCI DSS evidence; application assessment evidence for any P2PE application; the P2PE Instruction Manual; component provider validations; prior P2PE ROV and AOV.
Assessors
A PCI SSC qualified P2PE Assessor company (a QSA company additionally qualified for P2PE) with qualified P2PE assessor employees, producing the P2PE Report on Validation. Accredited by PCI Security Standards Council qualification.
Public register of assessors: https://www.pcisecuritystandards.org/assessors_and_solutions/point_to_point_encryption_assessors/
No firm has claimed a PCI P2PE assessor listing yet. Claim yours →
Consultants
A specialized ecosystem: P2PE assessor companies offer readiness services, and key management and HSM consultants help design decryption environments. Engagements typically take several months because device, application and key management domains are all in scope.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.