Webstore

RS ISO 9564-1: 2017
Financial services — Personal Identification Number (PIN) management and security — Part 1: Basic principles and requirements for PINs in card-based systems

Abstract

This document specifies the basic principles and techniques which provide the minimum security
measures required for effective international PIN management. These measures are applicable to
those institutions responsible for implementing techniques for the management and protection of PINs
during their creation, issuance, usage and deactivation.
This document is applicable to the management of cardholder PINs for use as a means of cardholder
verification in retail banking systems in, notably, automated teller machine (ATM) systems, pointof-
sale (POS) terminals, automated fuel dispensers, vending machines, banking kiosks and PIN
selection/change systems. It is applicable to issuer and interchange environments.
The provisions of this document are not intended to cover:
a) PIN management and security in environments where no persistent cryptographic relationship
exists between the transaction-origination device and the acquirer, e.g. use of a browser for online
shopping (for these environments, see ISO 9564-4);
b) protection of the PIN against loss or intentional misuse by the customer;
c) privacy of non-PIN transaction data;
d) protection of transaction messages against alteration or substitution;
e) protection against replay of the PIN or transaction;
f) specific key management techniques;
g) offline PIN verification used in contactless devices;
h) requirements specifically associated with PIN management as it relates to multi-application
functionality in an ICC.

General Information

Code	Classification	Theme	Pages	Publisher	Availability
RS ISO 9564-1: 2017	ADOPTED ISO STANDARDS	Information technology	45	First Edition Feb 2018	Available