PCI PTS POI v7.0 is the PCI Security Standards Council's security standard for payment terminals, PIN pads, kiosks and card readers. It adds rules for biometric sensors, isolated third-party apps, a 128-bit minimum cryptographic strength, and forward secrecy after a tamper event. Device makers get devices approved; merchants must deploy approved devices and protect them and the network around them under PCI DSS Requirement 9.5. Clone Systems covers that network side with PCI ASV scans from $185 a year per IP and penetration tests from $1,995.
The Payment Card Industry Security Standards Council (PCI SSC) has released Version 7.0 of the PIN Transaction Security (PTS) Point of Interaction (POI) Modular Security Requirements. This is a major update that strengthens the security baseline for all payment devices used in card-present transactions.
For businesses that deploy, operate, or manage payment terminals, this update is more than just a version change. It introduces key changes in physical and logical device protection, addresses modern payment technologies, and reshapes how compliance and integration are handled.
The official documents, including the full standard and supporting materials, are available on the PCI SSC website:
https://blog.pcisecuritystandards.org/just-published-pts-poi-v7-0
What is PCI PTS POI?
PCI PTS POI is the set of security requirements that govern devices like point-of-sale terminals, PIN pads, kiosks, and card readers. These devices must ensure secure PIN entry, encryption of cardholder data, protection against physical tampering, and safe handling of cryptographic keys.
Version 7.0 reflects today’s complex threat environment, where card-present attacks are more sophisticated, and payment devices increasingly incorporate biometric sensors, open software platforms, and wireless connectivity.
What changed in PCI PTS POI v7.0?
| Area | What v7.0 requires | What to ask your device vendor |
|---|---|---|
| Biometric sensors | Physical and logical controls that stop biometric data leaking or being misused | How is biometric data isolated from the payment functions? |
| Third-party apps | Apps (including app store apps) allowed only if isolated from payment functions and cryptographically authenticated | How are apps signed, and what can they reach? |
| Cryptography | At least 128-bit effective key strength for firmware authentication, key storage and encryption | Which algorithms and key lengths does the device use? |
| Tamper response | Keys may survive a tamper event only with forward secrecy and proof that extraction needs irreversible destruction | What happens to keys when the device is tampered with? |
| Accessibility | An accessible PIN entry mode that can be turned on per transaction | Is the accessible mode supported, and how is it secured? |
Biometric Interface Security
Devices with biometric components such as fingerprint sensors are now required to implement both physical and logical controls to prevent data leakage or misuse.
Support for Third Party Applications
The standard now permits the use of third party applications such as those from app stores on POI devices. However, these applications must be securely isolated from sensitive payment functions and properly authenticated using cryptographic techniques.
Stronger Cryptographic Baselines
All security functions involving firmware authentication, key storage, and data encryption must now use algorithms that offer at least 128 bit effective key strength.
Tamper Response and Forward Secrecy
Devices may retain cryptographic keys after a tamper event only if they use forward secrecy and can prove that extracting the keys would require irreversible destruction of the processing element.
Accessibility Enhancements
Version 7.0 allows for a PIN entry mode designed for accessibility to be enabled on a per transaction basis. This improves usability for individuals with disabilities while maintaining the required level of security.
What does PCI PTS POI v7.0 mean for merchants?
Device Management Is Now a Compliance Priority
Organizations must think beyond initial deployment. Ongoing lifecycle management including secure firmware updates, tamper monitoring, and device recertification is now a vital part of maintaining compliance and reducing exposure to risk.
Integration Can Make or Break Compliance
With modular components, a device might include individually certified elements. But the way these components are integrated is critical. Improper combinations or flawed assembly can result in a system that fails compliance altogether even if its parts are certified.
Remote Access Needs Stronger Controls
Remote management of POI devices especially for updating apps or firmware is increasingly common. PCI version 7.0 places significant focus on securing these connections, requiring mutual authentication, signed code updates, and strict data isolation.
Forward Secrecy Is Not Plug and Play
Implementing forward secrecy is not simple. It requires devices to prove that cryptographic keys are truly unrecoverable without physical destruction. This adds complexity for device manufacturers and demands greater due diligence from buyers.
Compliance Is a Minimum Not a Guarantee
A certified device deployed in an insecure environment is still vulnerable. Businesses need to take a layered approach that includes secure deployment, monitoring, vendor management, and physical inspections in addition to certification.
What should merchants do now?
Review the Standard
Familiarize your teams with the full PCI PTS POI version 7.0 standard and the summary of changes from version 6.2. Understand how the updates may impact your operations, device inventory, or vendor relationships.
Audit Your Current Devices
Determine which POI devices in your environment are certified under older versions. Plan with your vendors for hardware refreshes or recertification as needed.
Engage Vendors Proactively
Ask your device and application providers how they are addressing the new requirements especially around integration, third party application handling, and key protection.
Update Procurement and Deployment Policies
Incorporate version 7.0 requirements into your hardware selection, remote access management, and internal compliance policies to align with modern best practices.
Do I need a penetration test for PCI DSS?
Yes, if your SAQ or ROC includes Requirement 11.4. An ASV scan does not replace a penetration test. PCI DSS 4.0.1 requires internal and external penetration testing at least once every 12 months and after any significant change (11.4.2 and 11.4.3), and segmentation testing if you use segmentation to reduce scope (11.4.5, every six months for service providers under 11.4.6). To plan yours, see how often you should penetration test and what drives penetration test cost.
| Test | PCI DSS requirement | How often | What it proves |
|---|---|---|---|
| ASV scan | 11.3.2 | Every 3 months and after significant changes | Internet-facing systems have no known high-risk vulnerabilities |
| Internal vulnerability scan | 11.3.1 (authenticated: 11.3.1.2) | Every 3 months | Internal systems are patched and configured |
| External penetration test | 11.4.3 | Every 12 months and after significant changes | An attacker on the internet cannot exploit what the scan found |
| Internal penetration test | 11.4.2 | Every 12 months and after significant changes | One compromised host cannot reach cardholder data |
| Segmentation test | 11.4.5 / 11.4.6 | Every 12 months (6 for service providers) | Out-of-scope networks really are cut off from the CDE |
Clone Systems penetration tests start at $1,995 for a 30-day automated external and internal test and $2,495 for an authenticated web application test. See what Requirement 11.4 asks for, which SAQs include a penetration test, and penetration test pricing.
Navigating What’s Next
Staying aligned with PCI standards is about more than meeting requirements. It is about defending your systems, protecting your customers, and staying ahead of evolving threats. The release of PCI PTS POI version 7.0 signals a shift toward stronger, smarter payment security and businesses that act early will be better positioned to adapt.
Clone Systems, Inc. helps businesses do just that. As a trusted provider of vulnerability management, threat detection, and PCI compliance support, we deliver the visibility and expertise needed to secure complex environments and meet evolving requirements.
To learn how we can support your team, visit www.clone-systems.com.
