ISO 9564-1:2011
Financial services - Personal Identification Number (PIN) management and security - Part 1: Basic principles and requirements for PINs in card-based systems

Standard No.

ISO 9564-1:2011

Release Date

2011

Published By

International Organization for Standardization (ISO)

Status

Withdraw

Replace By

ISO 9564-1:2011/Amd 1:2015

Latest

ISO 9564-1:2017

Scope

This part of ISO 9564 specifies the basic principles and techniques which provide the minimum security measures required for effective international PIN management. These measures are applicable to those institutions responsible for implementing techniques for the management and protection of PINs during their creation, issuance, usage and deactivation. This part of ISO 9564 is applicable to the management of cardholder PINs for use as a means of cardholder verification in retail banking systems in, notably, automated teller machine (ATM) systems, point-of-sale (POS) terminals, automated fuel dispensers, vending machines, banking kiosks and PIN selection/change systems. It is applicable to issuer and interchange environments. The provisions of this part of ISO 9564 are not intended to cover: a) PIN management and security in environments where no persistent cryptographic relationship exists between the transaction-origination device and the acquirer, e.g. use of a browser for online shopping (for these environments, see ISO/TR 9564-4); b) protection of the PIN against loss or intentional misuse by the customer; c) privacy of non-PIN transaction data; d) protection of transaction messages against alteration or substitution; e) protection against replay of the PIN or transaction; f) specific key management techniques; g) offline PIN verification used in contactless devices; h) requirements specifically associated with PIN management as it relates to multi-application functionality in IC cards.

ISO 9564-1:2011 Referenced Document

• ISO 13491-1:2007 Banking - Secure cryptographic devices (retail) - Part 1: Concepts, requirements and evaluation methods
• ISO 13491-2:2005 Banking - Secure cryptographic devices (retail) - Part 2: Security compliance checklists for devices used in financial transactions
• ISO 9564-2 Financial services - Personal Identification Number (PIN) management and security - Part 2: Approved algorithms for PIN encipherment*， 2014-08-01 Update
• ISO/IEC 7812-1 Identification cards - Identification of issuers - Part 1: Numbering system*， 2017-01-01 Update
• ISO/IEC 7813 Information technology - Identification cards - Financial transaction cards
• ISO/IEC 7816-1 Identification cards - Integrated circuit cards - Part 1: Cards with contacts - Physical characteristics
• ISO/IEC 7816-2 Identification cards - Integrated circuit cards - Part 2: Cards with contacts - Dimensions and location of the contacts
• ISO/IEC 7816-3 Identification cards*， 2023-12-01 Update
• ISO/IEC 7816-4 Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange — Amendment 1: Support of multiple logical security devices*， 2023-08-01 Update

ISO 9564-1:2011 history

• 2017 ISO 9564-1:2017 Financial services - Personal Identification Number (PIN) management and security - Part 1: Basic principles and requirements for PINs in card-based systems
• 2015 ISO 9564-1:2011/Amd 1:2015 Financial services - Personal Identification Number (PIN) management and security - Part 1: Basic principles and requirements for PINs in card-based systems; Amendment 1
• 2011 ISO 9564-1:2011 Financial services - Personal Identification Number (PIN) management and security - Part 1: Basic principles and requirements for PINs in card-based systems
• 2002 ISO 9564-1:2002 Banking - Personal Identification Number (PIN) management and security - Part 1: Basic principles and requirements for online handling in ATM and POS systems
• 1991 ISO 9564-1:1991 Banking; Personal Identification Number management and security; part 1: PIN protection principles and techniques