Maestro Global Rules (PDF) - MasterCard

Security
8.3 Customer Compliance with Card Production Standards
• Card Design Standards
• Logical Security Requirements for Card Personalization
• MasterCard Physical Security Standards for Plastic Card Vendors
• Security Guidelines for Instant Card Issuance and Instant Card
Personalization
Card production activities subject to compliance with these Standards include,
by way of example and not limitation, the treatment and safeguarding of Cards,
Card manufacture, printing, embossing, encoding, and mailing, as well as to
any phase of the production and distribution of Cards or Account information.
The Customer must keep any media containing any Cardholder information,
including, without limitation, names, addresses, phone numbers, and Account
numbers, in an area limited to specially-designated personnel having access on
a need-to-know basis
8.3.1 Card Vendor Certification Requirements
Issuers must:
1. order Cards from a vendor certified as provided in Rule 8.3.1.1; and
2. require that their Card vendors conform to the Standards set forth in the
MasterCard Physical Security Standards for Plastic Card Vendors.
Issuers that manufacture their own Cards must be certified by the Corporation.
The Corporation reserves the right to inspect the Issuer’s Card manufacturing
facilities during business hours.
8.3.1.1 MasterCard Global Vendor Certification Program
The Corporation certifies vendors for Card production services under the Global
Vendor Certification Program. The Corporation applies the certification process
when a vendor requests certification for any of the following services:
• Manufacturing, embossing, and encoding Cards
• Personalizing Cards
• Mailing Cards to Cardholders
• Embedding and personalizing chips
• Data preparation
The program includes two phases of certification, which the Corporation may
undertake simultaneously:
©1993–2012 MasterCard. Proprietary. All rights reserved.
8-2 9 November 2012 • Maestro Global Rules