PCI CCA study guide
PCI CCA · Work through your exam, one topic at a time.
PCI CCA refers to the Card Production Security Assessor (CPSA) qualification listed by the PCI Security Standards Council under its PCI Qualified Professionals program. It is aimed at individuals and organizations that assess and validate compliance of card production and provisioning environments against the Council's Card Production and Provisioning security requirements, published in two companion documents: Physical and Logical. Candidates typically come from assessment firms, personalization bureaus, card manufacturers, and issuers' security teams. Preparation centers on reading both requirement sets closely, mapping each control to evidence an assessor would collect on site, and understanding how physical controls (facility zoning, access, media handling, destruction) interlock with logical controls (key management, access control, audit logging, system hardening, provisioning data protection). Topics on this exam: PCI Card Production and Provisioning – Physical Security Requirements and PCI Card Production and Provisioning – Logical Security Requirements. The PCI CCA study guide has 2 sections and about 742 words.
01Physical Security Requirements
This domain tests the physical controls around card production: how blank card stock, finished cards, personalization equipment, and sensitive components are protected from theft, substitution, and unauthorized access. The PCI Card Production and Provisioning – Physical Security Requirements set the baseline, and assessors look for implemented, evidenced controls rather than policy statements. The secure production area must have solid walls, floor, and ceiling, with controlled entry points; windows and other openings must be protected or eliminated. Access to card production and card storage areas requires two-factor authentication (for example, badge plus biometric or PIN).
377 words, about 2 min02Logical Security Requirements
The Logical Security domain covers systems that store, process, or transmit card production and provisioning data: personalization servers, HSMs, key management systems, and links to bureaus or mobile provisioning platforms. The PCI Logical Security Requirements test whether access, logging, cryptography, and change control are enforced technically. Every user must have a unique ID; shared or generic accounts are prohibited. Administrative and remote access requires strong authentication-typically multifactor-and should originate from trusted networks.
365 words, about 2 min