BS ISO 13491-2:2005 specifies checklists to be used to evaluate secure cryptographic devices (SCDs) incorporating cryptographic processes, as specified in parts 1 and 2 of ISO 9564, ISO 16609 and parts 1 to 6 of ISO 11568, in the financial services environment. IC payment cards are subject to the requirements identified in this part of ISO 13491 up until the time of issue, after which they are to be regarded as a “personal” device and outside of the scope of this document.
This part of ISO 13491 does not address issues arising from the denial of service of an SCD. In the checklists given in annexes A to H, the term “not feasible” is intended to convey the notion that although a particular attack might be technically possible it would not be economically viable, since carrying out the attack would cost more than any benefits obtained from a successful attack. In addition to attacks for purely economic gain, malicious attacks directed toward loss of reputation need to be considered.
BS ISO 13491-2:2005 history
2023BS ISO 13491-2:2023 Financial services. Secure cryptographic devices (retail). Security compliance checklists for devices used in financial transactions
2017BS ISO 13491-2:2017 Financial services. Secure cryptographic devices (retail). Security compliance checklists for devices used in financial transactions
2016BS ISO 13491-2:2016 Financial services. Secure cryptographic devices (retail). Security compliance checklists for devices used in financial transactions
2005BS ISO 13491-2:2005 Banking. Secure cryptographic devices (retail) - Security compliance checklists for devices used in financial transactions
2001BS ISO 13491-2:2001 Banking - Secure cryptographic devices (retail) - Security compliance checklists for devices used in magnetic stripe cards systems
2001BS ISO 13491-2:2000 Banking. Secure cryptographic devices (retail) - Security compliance checklists for devices used in magnetic stripe cards systems