Logical Security Requirements
Scope
The Logical Security domain covers systems that store, process, or transmit card production and provisioning data: personalization servers, HSMs, key management systems, and links to bureaus or mobile provisioning platforms. The PCI Logical Security Requirements test whether access, logging, cryptography, and change control are enforced technically.
Access, authentication, and logging
- Every user must have a unique ID; shared or generic accounts are prohibited.
- Administrative and remote access requires strong authentication-typically multifactor-and should originate from trusted networks.
- Passwords must meet the standard's length, complexity, history, and lockout settings; default vendor accounts and passwords must be removed or changed.
- Audit logs must capture user ID, date/time, event type, success or failure, and origin, and must be protected from alteration. Retain logs for at least 12 months, with the most recent 3 months readily available.
Key management and network controls
- Keys are generated, stored, and used inside approved cryptographic devices (HSMs). Key ceremonies require split knowledge and dual control: no single custodian knows or holds the complete key.
- Key components travel in tamper-evident packaging, separately, and are logged on receipt and use.
- Card production networks must be segmented from corporate and wireless networks; wireless is prohibited in sensitive areas or strictly segregated.
- Critical security patches are applied within one month; systems are hardened and malware protection is maintained.
Worked example
Two custodians generate a zone master key between an HSM and a host. Each receives one component in a separate tamper-evident package; both are present for the ceremony, each enters only their component, and the resulting key check value is recorded. A single custodian generating and knowing the full key would violate split knowledge and dual control.
Traps
- Sharing an administrator account for convenience.
- Emailing key components or shipping them in one package.
- Retaining logs for only 30 days and calling it compliant.
- Leaving default accounts enabled on personalization servers.