PCI CCA cheat sheet

Secure area classification tiers: card production areas are restricted to authorized personnel only; access requires badge plus biometric or two-factor authentication at entry points to high-security zones such as embossing, chip embedding, and PIN mailer printing.

Visitor control rule: all visitors must be escorted at all times in production areas, sign a log with name, company, purpose, time in/out, and be issued a distinguishable visitor badge; escort ratio and badge color must differ from employees.

Access revocation: badges and system access must be revoked within 24 hours of termination or role change (same-day for involuntary termination), with a documented audit trail of revocation.

Media and asset inventory: blank cards, chip modules, and magnetic stripe stock must be logged on receipt, stored in locked vaults with dual control, and reconciled at each shift change; discrepancies trigger investigation.

Dual control and split knowledge: no single person may have both access to card stock and the ability to produce finished cards; vault access requires two authorized persons, and key components are split among at least two custodians.

CCTV requirement: cameras must cover entry/exit, vaults, embossing, chip embedding, PIN mailer printing, and shipping; recordings retained at least 90 days (or per policy) and reviewed for incidents; camera coverage must include the card stock vault door.

Destruction rule: rejected, defective, and expired cards must be destroyed by cross-cut shredding, incineration, or approved degaussing, witnessed and documented with a destruction log listing card counts and serial ranges.

Shipping and receiving: finished cards and PIN mailers must be shipped separately, in tamper-evident packaging, tracked, and delivered to a controlled address; PIN mailers must never ship in the same envelope as the card.

Alarm and intrusion: vaults and high-security areas require monitored intrusion alarms with response procedures, and doors must be self-closing and alarmed; alarm activation logs retained for audit.

Key management principle: cryptographic keys used for card personalization and PIN encryption must be generated in a secure module (HSM), stored encrypted, and split using dual control/split knowledge; no cleartext key material in scripts or config files.

Key rotation and destruction: keys have defined cryptoperiods, are rotated on compromise or at defined intervals, and retired keys are destroyed with documented certificate of destruction; key inventory must be maintained.

PIN security: PINs must be encrypted at the point of entry (PIN pad), transmitted only in encrypted form using approved algorithms (e.g., TDES/AES), and never stored in cleartext; PIN blocks must be translated inside an HSM.

Access control for personalization systems: role-based access with least privilege; production operators cannot modify personalization data or key material; changes require dual authorization and are logged.

Audit logging: all access to cardholder data, key operations, and personalization jobs must be logged with user ID, timestamp, action, and result; logs protected from modification and retained per policy (minimum 1 year, 3 months readily available).

Data integrity: personalization data files must be protected by cryptographic checksums or MACs; the personalization system must verify integrity before processing and reject tampered files.

Segregation of duties: functions of key custodian, security administrator, and production operator must be separated; no single role may both authorize and execute key ceremonies.

Network security: card production networks must be segmented from corporate networks, with firewalls, IDS/IPS, and no direct internet access from personalization systems; remote access requires MFA and logging.

Change management: all changes to personalization software, key management systems, and configurations require documented approval, testing, and rollback plans before deployment.