Spartak - Fotolia

Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

What does PCI say about physical point-of-sale security?

Physical point-of-sale security is covered in PCI DSS. Expert Mike Chapple explains how to use good security practices and understand PCI requirements for POS terminals.

I'm concerned about physical security of compliance-related systems, and I'm having a hard time finding information...

about the proper way to secure physical keys that open locked drawers to point-of-sale systems. Would it be PCI compliant to just hide keys around my desk or have them lying out rather than have them in a key safe or other secure measure? What are the PCI compliance requirements regarding physical point-of-sale security?

PCI DSS does not directly address the keys used to lock cash drawers in POS systems. If you really want to leave the keys lying around on your desk, you're probably not violating PCI DSS unless you're actually storing credit card numbers in those drawers (which you should not be doing anyway). That said, you should use good security practices, such as a safe, to protect the keys to drawers full of cash.

PCI DSS contains some provisions around physical point-of-sale security. Terminals are often in locations where it is difficult to provide strong physical security, such as at the front of retail stores. The standard requires that merchants take steps to prevent devices from tampering, such as the installation of key loggers and skimmers that could steal payment card transaction data.

Merchants with POS systems must maintain a detailed inventory of those systems, including the make, model, location and serial number of each device used to capture payment card data. They must also periodically inspect devices for signs of tampering or unauthorized replacement. Finally, merchants must train staff on proper physical point-of-sale security procedures for POS terminals.

Ask the Expert:
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today. (All questions are anonymous.)

Next Steps

Test your PCI DSS knowledge with this quiz, plus take a closer look at the changes in PCI DSS version 3.1 and what Apple Pay tokenization means for PCI compliance.

This was last published in October 2015

Dig Deeper on PCI Data Security Standard