PCI CCA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Dual control

A security principle requiring two or more authorized individuals to act together to complete a sensitive operation, such as vault access or key loading, so no single person can compromise card stock or keys.

Split knowledge

A key management technique where a cryptographic key or combination is divided into components held by separate custodians, none of whom knows the complete value; components are combined only during authorized ceremonies.

PIN mailer separation

A physical security rule requiring PIN mailers to be printed and shipped separately from the corresponding payment card, never in the same envelope, to prevent interception of both card and PIN.

Visitor escort rule

All visitors in card production areas must be logged, issued a distinct badge, and continuously escorted by authorized personnel; unescorted access is prohibited regardless of visitor seniority.

Card stock vault

A locked, monitored storage area for blank cards, chip modules, and magnetic stripe stock, requiring dual control access, inventory logging on receipt and issue, and periodic reconciliation.

Tamper-evident packaging

Packaging designed to show visible evidence if opened or altered, used for shipping finished cards and PIN mailers so recipients can detect interception during transit.

CCTV retention period

Video surveillance recordings covering vaults, production floors, and shipping areas must be retained for a defined minimum period (commonly 90 days) and reviewed for security incidents.

Destruction log

A documented record of destroyed cards listing serial ranges, counts, method (shredding, incineration, degaussing), date, and witnessing personnel, retained as audit evidence.

Access revocation timeframe

Badges and logical access must be revoked within 24 hours of termination or role change, with same-day revocation for involuntary terminations, and the action recorded in an audit trail.

HSM key generation

Cryptographic keys for card personalization and PIN processing must be generated inside a hardware security module, never exported in cleartext, and stored encrypted with dual control.

PIN block translation

The process of decrypting an encrypted PIN block and re-encrypting it under a different key inside an HSM, allowing secure PIN movement between systems without cleartext exposure.

Cryptoperiod

The defined time span during which a cryptographic key is authorized for use; keys must be rotated at the end of the cryptoperiod or upon suspected compromise.

Key ceremony

A formal, witnessed procedure for generating, loading, or destroying key components, documented with participant identities and split-knowledge controls to ensure no single person knows the full key.

Least privilege

An access control principle granting users only the minimum permissions needed for their role, so production operators cannot modify personalization data or key material.

Segregation of duties

Separation of key custodian, security administrator, and production operator roles so no individual can both authorize and execute sensitive operations such as key ceremonies.

Audit log retention

Security and access logs must be protected from modification and retained per policy, typically at least one year with three months readily available for examination.

Data integrity MAC

A cryptographic checksum or message authentication code applied to personalization data files so the system can verify integrity and reject tampered input before card production.

Network segmentation

Isolating card production and personalization networks from corporate and internet networks using firewalls and monitoring, limiting lateral movement if a compromise occurs.

PIN encryption at entry

PINs must be encrypted at the point of entry by an approved PIN pad using strong algorithms, transmitted only encrypted, and never stored or logged in cleartext.

Change management approval

All changes to personalization software, key systems, and configurations require documented approval, testing, and a rollback plan before deployment into production.

Badge color differentiation

Visitor and contractor badges must be visually distinct from employee badges so personnel can readily identify and challenge individuals who are not authorized for unescorted access.

Inventory reconciliation

Periodic comparison of physical card stock and chip module counts against system records, performed at shift changes or defined intervals, with discrepancies triggering investigation.

Monitored intrusion alarm

Vaults and high-security production areas require alarms monitored by a response service, with self-closing alarmed doors and retained activation logs for audit review.

Controlled delivery address

Finished cards and PIN mailers must ship to a controlled, pre-approved address with tracking, not to arbitrary locations, reducing risk of interception in transit.

Key inventory record

A maintained register of all cryptographic keys listing identifiers, custodians, cryptoperiods, and destruction dates, enabling audit of key lifecycle and compromise response.

Certificate of destruction

Formal documentation confirming that key material or card stock was destroyed, including date, method, and witnesses, retained as evidence for audits and investigations.

Remote access MFA

Any remote access to personalization or key management systems must require multi-factor authentication, be logged, and be restricted to authorized administrators.

Personalization data file

The input containing cardholder data used to emboss, encode, and personalize cards; it must be integrity-protected, access-controlled, and deleted after production per policy.

Job authorization

Each personalization job requires documented authorization verifying card counts, data source, and recipient before production begins, preventing unauthorized card issuance.

Shift change reconciliation

At each shift handover, card stock, finished cards, and rejected cards are counted and reconciled against records, with dual sign-off to detect loss or theft.

Approved destruction methods

Accepted card destruction methods include cross-cut shredding, incineration, and approved degaussing for magnetic media, each witnessed and recorded in a destruction log.

Key compromise response

Upon suspected key compromise, the key is retired immediately, affected cards or PINs are re-protected, and an incident report documents the timeline and remediation.