Frequently Asked Question
For P2PE Requirement 3B-1, are solution providers required to maintain the physical security of devices throughout their lifecycle regardless of where the devices are located?
This is a Technical FAQ for P2PE versions 1.x. This is a "normative" FAQ that is considered to be part of the P2PE requirements and shall be considered during a P2PE assessment in the same light as the published P2PE standard. These technical FAQs are also published together in "Technical FAQs for use with P2PE Versions 1.x" available in the Documents Library of this website.
Solution providers and their agents are required to maintain strict control of the devices while in their possession (for example, prior to deployment, during replacement, or prior to device destruction). Once a merchant receives a device, it is thereafter the merchant's responsibility to manage the physical security of that device (as defined in the PIM) unless they ship it back to the solution provider or a solution provider's agent, or unless arrangements have been made between the solution provider and merchant for the ongoing management of the devices on the merchant's behalf.
Solution providers and their agents are required to maintain strict control of the devices while in their possession (for example, prior to deployment, during replacement, or prior to device destruction). Once a merchant receives a device, it is thereafter the merchant's responsibility to manage the physical security of that device (as defined in the PIM) unless they ship it back to the solution provider or a solution provider's agent, or unless arrangements have been made between the solution provider and merchant for the ongoing management of the devices on the merchant's behalf.
September 2015
Article Number: 1349