Maestro Global Rules (PDF) - MasterCard

Security
8.4 PIN and Key Management Security Requirements
• Assessment of the physical security of the vendor’s site, and
• Assessment of the logical security of the vendor’s data network environment,
hardware, and software. All personalizers using an Internet connection or
wireless LAN to transfer Issuer or Cardholder data must also undergo a
network security scan as described in Rule 8.6 of the Site Data Protection
Program.
The list of vendors that the Corporation has certified to provide Card production
services, Certified Vendors (for Card Production Services of Any MasterCard,
Maestro, or Cirrus Branded Card) is continually updated. From time to time,
the Corporation distributes the current list, which supersedes all previously
published lists, in a Global Security Bulletin.
8.3.1.2 Card Design and Production
Prior to production, one full color reproduction of the Card with the appropriate
Marks must be submitted to the Licensing & Approvals department for approval.
When approval is granted, the manufacturer must send two (2) sample Cards of
the actual printed stock to the Licensing & Approvals department.
Only after written confirmation of the Card design approval, may the
manufacturer manufacture and deliver the Cards to the Issuer. Subsequent
deliveries of an unchanged Card design do not require separate approval.
8.4 PIN and Key Management Security Requirements
All Customers acquiring PIN transactions must comply with the security
requirements for PIN and key management as specified in the Payment Card
Industry PIN Security Requirements.
All Customers performing Issuer PIN processing must refer to the Issuer PIN
Policy and Guidelines for all aspects of Issuer PIN management and PIN key
management including PIN selection, transmission, storage, usage guidance,
and PIN change.
8.4.1 PIN Verification
The Issuer is permitted to use the PIN verification algorithm of its preference.
Refer to “PIN Generation Verification” in the Single Message System
Specifications, Chapter 6, “Encryption,” for more information about PIN
verification that the Single Message System performs directly for Maestro Issuers.
Refer to “PIN Verification” in the Authorization System Manual, Chapter 9,
“Authorization Services Details,” for more information about the MasterCard PIN
verification service, in which Single Message System performs PIN verification
on behalf of MasterCard issuers, and the two PIN verification methods (IBM
3624 and ABA) supported by the PIN verification service.
©1993–2012 MasterCard. Proprietary. All rights reserved.
Maestro Global Rules • 9 November 2012 8-3