PCI Card Production Security: Logical and Physical Requirements for Card Vendors

What Is PCI Card Production Security?

PCI card production security refers to the security requirements that the PCI Security Standards Council (PCI SSC) defines for entities that produce payment cards or provision payment credentials on behalf of the payment brands. It is set out in two companion standards: the PCI Card Production and Provisioning Logical Security Requirements and the Physical Security Requirements.

The PCI SSC describes these as separate standards, not subsets of PCI DSS or any other PCI standard. Version 3.0 was published in January 2022, followed by v3.0.1 in June 2022, and v2 validation documents were retired on January 1, 2023. In February 2026, the PCI SSC opened an exploratory request for comments on both v3.0.1 standards, so vendors should monitor for future revisions.

Who Must Comply With PCI Card Production Requirements?

The requirements apply to entities that perform card production and provisioning activities at the request of the payment brands. According to the PCI SSC, this includes:

Card manufacturers and chip embedders
Personalizers, pre-personalizers, and data preparation providers
Fulfillment, card storage, shipping, and mailing providers
Entities performing cloud-based or secure element (SE) provisioning
Entities managing over-the-air (OTA) personalization, lifecycle management, and associated cryptographic keys

Merchants and most service providers are not in scope. They follow PCI DSS instead, although many card vendors must comply with PCI DSS as well where they store, process, or transmit cardholder data.

What Do the PCI Card Production Physical Security Requirements Cover?

The physical requirements protect card products and components from theft, substitution, and misuse throughout manufacturing, personalization, storage, and shipping. They govern who can enter secure areas, how materials are tracked, and how activity is monitored.

Core control areas include:

High Security Areas (HSAs): Production activities such as manufacturing, chip embedding, personalization, packaging, and shipping take place within controlled areas with strict access rules.
Vault controls: Card stock and sensitive components are stored in hardened vaults with dual control over access and inventory.
Access control and surveillance: Electronic access control and CCTV monitor entry and production activity.
Personnel security: Background screening and role-based access for staff in secure areas.
Audit trails and reconciliation: Card components are counted and reconciled at each production step.
Secure destruction: Rejected cards, materials, and printing elements are destroyed under controlled, documented processes.
Packaging and delivery: Shipments are prepared and released under controls that prevent tampering or loss.

According to the PCI SSC v3.0 announcement, v3.0 added an appendix on using a Security Operations Center to control security management systems, along with requirements for rail freight and for transport to and from sea and air freight facilities.

What Do the PCI Card Production Logical Security Requirements Cover?

The logical requirements protect the data and cryptographic material used to personalize and provision payment cards. They focus on the confidentiality of personalization data throughout its lifecycle and on the protection of issuer keys.

Key areas include:

Personalization data security: Protection during transfer, access, storage, and destruction.
Cryptographic key management: Secure generation, storage, use, and destruction of issuer and transport keys.
PIN processes: Security of PIN generation, PIN mailers, and related distribution.
Network and system security: Segmentation, hardening, and monitoring of personalization and provisioning environments.
User and access management: Controlled, accountable access to systems holding sensitive data and keys.
Provisioning security: Controls for cloud-based, SE, and OTA provisioning services.

Dimension	Physical Requirements	Logical Requirements
Protects	Card products, components, and facilities	Personalization data, keys, and PIN data
Typical controls	HSAs, vaults, CCTV, dual control, secure shipping	Encryption, key management, segmentation, access control
Assessor	CPSA-Physical	CPSA-Logical
Common evidence	Access logs, inventories, destruction records, surveillance records	Key ceremonies, configuration standards, data flow and retention records

How Is PCI Card Production Compliance Validated?

PCI card production compliance is validated through assessments by Card Production Security Assessors, while the payment brands manage the compliance programs and decide which entities must validate. The PCI SSC trains and qualifies CPSA-Logical and CPSA-Physical assessors to independently assess card production environments under the CPSA Program Guide.

Two practical points matter for vendors:

Confirm brand expectations first: The PCI SSC directs vendors to the individual payment brands for validation timing and requirements.
Plan for both tracks: Many vendors require both logical and physical assessments, which may involve different assessors and evidence sets.

Card production assessors do not need to be QSAs. The PCI SSC separated these qualifications because PCI DSS knowledge is not a prerequisite for the card production standards.

What Are the Common Gaps in Card Vendor Security Programs?

The most common gaps occur where physical and logical controls meet, such as administration of CCTV and access control systems, key handling during personalization, and data retention in personalization systems. Other frequent issues include:

Incomplete reconciliation records that cannot account for every card component.
Dual control applied inconsistently across shifts or sites.
Personalization data retained longer than necessary.
Weak segregation between personalization networks and corporate IT.
Undocumented key ceremonies or unclear key custodian responsibilities.
Provisioning platforms added without updating scope or controls.

Vendors that also manage PIN data should align card production controls with the PCI PIN Security Requirements, since many key management expectations overlap.

How Should Card Vendors Prepare for a PCI Card Production Assessment?

Card vendors should prepare by confirming scope with the payment brands, mapping every facility and system to the logical and physical requirements, and validating controls before the formal assessment. A practical sequence:

Inventory all production, personalization, storage, and provisioning activities by site.
Map each activity to the relevant logical and physical requirements.
Conduct a gap assessment covering both standards.
Test technical controls through network vulnerability assessments of personalization and provisioning environments.
Organize evidence such as logs, inventories, key ceremony records, and destruction records.
Align overlapping obligations under PCI DSS where cardholder data is also in scope.

Ampcus Cyber’s PCI Card Production compliance services help card manufacturers, personalization bureaus, fulfillment providers, and digital provisioning providers interpret PCI CPP requirements, strengthen controls, and prepare for assessment with practical guidance tailored to their operational environments.

Strengthening PCI Card Production Security for Long-Term Compliance

PCI card production security protects one of the most sensitive stages of the payment lifecycle. The physical and logical standards work together, and many gaps appear where they meet. Vendors that treat both as a single, continuously maintained program will be better positioned for brand reviews and future revisions of the standards.

Preparing for a PCI card production assessment?

Speak with Ampcus Cyber to assess your logical and physical controls, close gaps before validation, and build a card production security program that holds up to payment brand scrutiny.