What it means
Payment terminal security protects point-of-interaction devices through approved design, inventory, deployment, physical inspection, tamper awareness, access control, maintenance, and replacement procedures.
Why it matters
A secure device can still be substituted, modified, misconfigured, or serviced by an unauthorized person when operational custody and inspection are weak.
Practical focus
- Maintain device identity, model, serial, location, owner, status, configuration, software, and chain-of-custody records.
- Train personnel to inspect for substitution or tampering and to verify service technicians and replacement devices.
- Control deployment, storage, transport, remote management, maintenance, decommissioning, and incident escalation.
- Preserve this evidence: Retain approved definitions, decisions, operating records, exceptions, test results, and change history that show how Payment Terminal Security works over time.
- Exercise this failure scenario: An attacker replaces a checkout terminal with a look-alike device because staff do not verify serial numbers or technician identity.
Common mistakes
- Using Payment Terminal Security as a label without defining its scope, owner, decision criteria, and expected evidence.
- Treating a diagram, policy, tool screen, or meeting as proof that Payment Terminal Security operates consistently in real work.
- Optimizing for a one-time review while leaving normal operating decisions, exceptions, and handoffs uncontrolled.
- Testing only the expected path and never rehearsing this failure condition: An attacker replaces a checkout terminal with a look-alike device because staff do not verify serial numbers or technician identity.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: