Maestro Global Rules (PDF) - MasterCard

Chapter 8 Security
This chapter contains information about security requirements.
8.1 Compliance .............................................................................................................................. 8-1
8.2 Terminal Compliance Requirements ........................................................................................ 8-1
8.3 Customer Compliance with Card Production Standards........................................................... 8-1
8.3.1 Card Vendor Certification Requirements ......................................................................... 8-2
8.3.1.1 MasterCard Global Vendor Certification Program................................................... 8-2
8.3.1.2 Card Design and Production .................................................................................. 8-3
8.4 PIN and Key Management Security Requirements ................................................................... 8-3
8.4.1 PIN Verification ............................................................................................................... 8-3
8.4.2 Stand-In Authorization—Europe Region Only ................................................................ 8-4
8.4.3 PIN Transmission between Customer Host Systems and the Interchange System........... 8-4
8.5 PIN Entry Device...................................................................................................................... 8-4
8.6 POS Terminal Communication Protocol................................................................................... 8-5
8.6.1 Account Protection Standards ......................................................................................... 8-5
8.6.2 Wireless POS Terminals and Internet/Stand-alone IP-enabled POS Terminal Security
Standards ................................................................................................................................. 8-6
8.7 Component Authentication ...................................................................................................... 8-7
8.8 Triple DES Standards................................................................................................................ 8-7
8.9 Account Data Compromise Events........................................................................................... 8-7
8.9.1 Policy Concerning Account Data Compromise Events and Potential Account Data
Compromise Events ................................................................................................................. 8-8
8.9.2 Responsibilities in Connection with ADC Events and Potential ADC Events .................. 8-9
8.9.2.1 Time-Specific Procedures for ADC Events and Potential ADC Events.................. 8-10
8.9.2.2 Ongoing Procedures for ADC Events and Potential ADC Events ......................... 8-12
8.9.3 Forensic Report ............................................................................................................. 8-13
8.9.4 Corporation Determination of ADC Event or Potential ADC Event............................... 8-15
8.9.4.1 Assessments for PCI Violations in Connection with ADC Events ......................... 8-15
8.9.4.2 Potential Reduction of Financial Responsibility.................................................... 8-15
8.9.4.3 Investigation and Other Costs .............................................................................. 8-16
8.9.5 Assessments for Noncompliance................................................................................... 8-16
8.10 Site Data Protection Program ............................................................................................... 8-17
8.10.1 Payment Card Industry Data Security Standard ........................................................... 8-17
8.10.2 Compliance Validation Tools....................................................................................... 8-18
8.10.3 Vendor Compliance Testing......................................................................................... 8-18
©1993–2012 MasterCard. Proprietary. All rights reserved.
Maestro Global Rules • 9 November 2012 8-i