Frequently Asked Question

This is a “normative” FAQ - It is considered to be part of the P2PE requirements and shall be considered during a P2PE assessment in the same light as the published P2PE standard. 
 
A PCI PTS-approved POI device with SRED where the PTS listing indicates “Non CTLS” (indicating that the contactless interface was not included in the SRED evaluation) is eligible for use in a PCI P2PE solution only if one of the following applies:

1. All contactless interfaces are disabled (and cannot be enabled by the merchant) at all times while deployed in the PCI P2PE solution.

2. The PCI PTS approved POI device:

(a) Was validated under PTS POI v3.0, including the SRED module, prior to release of criteria for evaluating contactless (CTLS) interfaces in PTS POI v3.1, and

(b) Successfully completes required annual supplemental contactless evaluations (“SCE”) by the originating PTS lab, validating compliance with a subset of PTS POI requirements relating to vulnerability to common logical security attacks.

PCI PTS-approved POI devices meeting the requirements of item 2(a) above and identified as “Non-CTLS” on the listing of PTS Approved Devices are considered to be “Permitted Non-CTLS Devices.” Permitted Non-CTLS Devices that meet (and continue to meet) Requirement 2(b) above are acceptable for use in P2PE solutions and are listed in the table below. Once these devices are evaluated as part of a P2PE Solution, they will be included on the list of Validated P2PE Solutions with an explanatory note. A Permitted Non-CTLS Device that no longer meets Requirement 2(b) per the annual SCE may be delisted from the list of Validated P2PE Solutions if the contactless interface cannot be disabled.

IMPORTANT NOTES:

• The SCE entails validation of contactless interfaces against SRED logical criteria only.  The SCE does not include validation against SRED physical criteria.  Accordingly, the contactless interfaces of Permitted Non-CTLS Devices have NOT undergone a full PTS evaluation, and are not SRED approved. 

• Potential risks of using Permitted Non-CTLS Devices should be discussed with the applicable P2PE Solution provider or vendor, or with a merchant’s acquirer.

Model

Firmware Number noted as “SRED (Non-CTLS)”

PTS Approval

SCE Expiry Date

Ingenico IWL220, IWL250

820528v02.xx

4-20181

December 31, 2016

Ingenico iSMP

820528V02.xx

4-20183

December 31, 2016

Ingenico iCT220, iCT250

820528V02.xx

4-20196

November 30, 2016

Ingenico iPP310, iPP320, iPP350

820528V02.xx

4-20184

October 31, 2016