PCI SPoC 2026: Yuav npaj dab tsi rau kev them nyiaj PIN hauv xov tooj?

Lo lus teb luv luv: hnub tim 31/10/2026 tsis yog hnub uas txhua txoj kev daws teeb meem PCI SPoC yuav tsum nres. Raws li PCI Security Standards Council Bulletin: Announcement of Sunset Periods for the PCI SPoC and PCI CPoC Standards, PCI SSC yuav pib lub sijhawm sunset txij hnub tim 1/5/2026 txog rau hnub tim 31/10/2026. Tom qab hnub ntawd, PCI SSC yuav tsis txais cov ntaub ntawv thov SPoC tshiab ntxiv lawm; cov listing uas twb tau txais yuav txuas ntxiv raws li lawv lub voj voog siv, hnub tas sijhawm thiab cov kev xav tau saib xyuas uas siv rau txhua listing.

Yog li, cov khw uas tab tom siv kev them nyiaj ntaus tus lej PIN hauv xov tooj tsis tsim nyog nres lawv lub system tsuas yog vim hnov lo lus “sunset”. Yam yuav tsum ua yog txheeb xyuas tias listing uas siv tiag tiag tseem siv tau txog thaum twg, qhov teeb tsa tam sim no puas phim listing, PCI DSS cov luag haujlwm poob rau leej twg, thiab yuav siv txoj kev twg hloov yog tias tsim nyog.

Nkag siab kom raug txog hnub sunset thiab qhov xwm txheej ntawm txoj kev daws teeb meem uas tab tom siv

SPoC yog lo lus luv ntawm Software-based PIN Entry on COTS, uas txhais tias yog txoj kev daws teeb meem rau kev ntaus tus lej PIN rau ntawm cov cuab yeej lag luam siv dav (commercial off-the-shelf, COTS) xws li xov tooj lossis ntsiav tshuaj. Raws li PCI SSC piav qhia hauv Software-based PIN Entry on COTS (SPoC), ib txoj kev daws teeb meem SPoC uas ua tiav feem ntau cuam tshuam nrog app ntaus PIN, lub cuab yeej nyeem daim npav muaj kev ruaj ntseg (SCRP), COTS thiab lub server-side system rau kev saib xyuas thiab txheeb xyuas nyob deb.

Qhov tseem ceeb uas yuav tsum cais kom meej yog lub sijhawm sunset ntawm qhov kev pab txais cov ntaub ntawv thov thiab kev tas sijhawm ntawm ib listing tshwj xeeb tsis yog tib yam. Cov listing uas twb muaj lawm yuav tsis cia li tas siv rau hnub tim 31/10/2026; lub lag luam tseem yuav tsum ua raws hnub tas sijhawm, lub sijhawm rov ntsuam xyuas thiab cov kev xav tau saib xyuas uas siv rau listing ntawd.

Lub khw yuav nyob rau hauv ib qho ntawm peb yam xwm txheej no:

1. Tab tom siv ib listing SPoC uas tseem siv tau: tsis tau muaj pov thawj txaus los xaus tias yuav tsum hloov tam sim ntawd. Txawm li cas los xij, yuav tsum sau tseg hnub tas sijhawm, cov kev xav tau saib xyuas thiab tus muab kev pab txoj kev npaj txhawb nqa.
2. Tab tom sim lossis xaiv ib txoj kev daws teeb meem uas tseem tsis tau muaj listing: tsis txhob xav tias kev muab app, card reader thiab server system los sib txuas yuav cia li tsim tau ib txoj kev daws teeb meem SPoC uas siv tau. PCI SSC hais meej tias tsuas yog ib txoj kev daws teeb meem SPoC uas ua tiav, tau txais kev pom zoo thiab muaj listing lawm xwb thiaj nyob hauv qhov kev pab no, raws li tau hais hauv New FAQs on Software-based PIN Entry on COTS.
3. Xav tau kev teeb tsa tshiab lossis kev txhawb nqa mus ntev: yuav tsum nug tus muab kev pab txog PCI MPoC, uas yog tus qauv uas PCI SSC piav qhia tias tsim los ntawm lub hauv paus ntawm SPoC thiab CPoC, lossis xav txog cov cuab yeej them nyiaj tshwj xeeb.

Sunset ib leeg tsis yog pov thawj tias kev them nyiaj ntaus tus lej PIN hauv xov tooj twb tsis muaj kev nyab xeeb lawm. Nws qhia tias qhov kev pab SPoC yuav tsis txais cov ntaub ntawv thov tshiab ntxiv tom qab lub sijhawm uas tau tshaj tawm lawm, hos lub lag luam yuav tsum tswj hwm lub voj voog siv ntawm txoj kev daws teeb meem tshwj xeeb uas nws tab tom siv.

Txheeb xyuas listing, qhov teeb tsa thiab PCI DSS cov luag haujlwm

Sib piv txoj kev daws teeb meem tiag tiag nrog listing

Kom tus muab kev pab muab cov ntaub ntawv sau ua ntawv qhia meej txog lub npe tiag tiag ntawm txoj kev daws teeb meem, tus lej lossis tus cim xa mus rau listing, SPoC version, hnub rov ntsuam xyuas, hnub tas sijhawm thiab qhov xwm txheej ntawm kev txhawb nqa. Tsis txhob saib xyuas lub npe lag luam ntawm app xwb. Yuav tsum sib piv nrog qhov teeb tsa uas lub khw tab tom siv tiag tiag, suav nrog:

• version ntawm payment app thiab operating system;
• hom xov tooj lossis ntsiav tshuaj COTS;
• hom secure card reader SCRP;
• server system rau kev saib xyuas thiab txheeb xyuas, nrog rau cov version uas cuam tshuam;
• cov kev txwv lossis cov xwm txheej siv uas tau teev rau hauv listing.

Koj tuaj yeem tsim ib daim inventory checklist uas muaj cov kem xws li: tus muab kev pab lub tuam txhab raug cai, listing lub npe thiab tus lej, app version, SCRP hom, hnub tas sijhawm lossis hnub rov ntsuam xyuas, qhov xwm txheej ntawm kev txhawb nqa, MPoC roadmap lossis txoj kev hloov, thiab tus neeg tiv tauj rau daws teeb meem. Tom qab ntawd muab cov ntaub ntawv piv nrog PCI SSC cov ntaub ntawv thiab daim ntawv cog lus kev pab. Yog tus muab kev pab tsuas teb dav dav tias “txoj kev daws teeb meem ua raws PCI” tab sis tsis qhia tau listing thiab qhov teeb tsa uas phim, cia li suav tias qhov no tseem tsis tau raug txheeb xyuas.

Faib kom meej PCI DSS cov luag haujlwm

SPoC yog ib qho kev pab ntsuam xyuas txoj kev daws teeb meem; nws tsis hloov tag nrho lub khw cov luag haujlwm raws PCI DSS. PCI DSS siv rau cov koom haum lossis chaw ua lag luam uas khaws, ua haujlwm nrog lossis xa cov ntaub ntawv ntawm payment account; kev lag luam tsawg tsis txhais tias cia li raug zam ntawm lub luag haujlwm tiv thaiv cov ntaub ntawv. Lub tuam txhab txais nyiaj, payment organization lossis acquiring entity yuav yog tus txiav txim seb yuav siv hom ntawv pov thawj ua raws cai twg. Saib ntxiv hauv Do small merchants with limited transaction volumes need comply with PCI DSS?.

Txawm tias ntiav ib tug thib peb los ua payment processing thiab tsis khaws, tsis ua haujlwm nrog lossis tsis xa daim npav cov ntaub ntawv ncaj qha, PCI DSS qhov kev siv tau yuav nqaim dua, tabsis lub luag haujlwm tsis ploj. Lub lag luam tseem yuav tsum txheeb xyuas tus muab kev pab qhov xwm txheej ua raws cai, muaj daim ntawv cog lus sau tseg meej txog txhua tog lub luag haujlwm thiab ua raws hom ntawv pov thawj uas tau thov. Saib Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?.

Nug lub tuam txhab txais nyiaj, acquiring entity lossis tus muab kev pab kom sau ntawv teb yam tsawg kawg rau cov lus nug no:

1. Lub khw yuav tsum ua kom tiav SAQ lossis hom ntawv pov thawj PCI DSS twg?
2. Txoj kev them nyiaj ntaus tus lej PIN hauv xov tooj nyob hauv thaj tsam ntawm lub system thiab leej twg lub luag haujlwm?
3. Tus muab kev pab lav ris rau cov kev xav tau twg, thiab lub khw lav ris rau cov kev xav tau twg?
4. Yog listing tas sijhawm ua ntej hloov pauv tiav, yuav siv txoj kev twg los txais kev lag luam txuas ntxiv?

Npaj kev hloov pauv thiab txheeb xyuas ua ntej hloov

Ua raws cov kauj ruam hauv qab no kom tsis txhob tos txog thaum listing tas sijhawm mam pib daws:

1. Sau npe tag nrho lub system: sau tseg txhua lub xov tooj, ntsiav tshuaj, SCRP reader, app, version, tus account tswj hwm thiab qhov chaw muag khoom uas tab tom siv.
2. Txheeb xyuas listing: muab txoj kev daws teeb meem tiag tiag piv nrog listing, hnub tas sijhawm, lub sijhawm rov ntsuam xyuas thiab cov kev xav tau saib xyuas.
3. Rov tshuaj xyuas daim ntawv cog lus: nrhiav cov nqe lus hais txog kev hloov qauv, kev txhawb nqa version, teeb meem kev ruaj ntseg, kev ceeb toom txog hnub tas siv, theem kev pabcuam thiab tus nqi hloov mus rau lwm txoj kev.
4. Teem kom meej tus neeg ris lub luag haujlwm: thov kom lub txhab nyiaj them nyiaj lossis tus payment acquirer lees paub hom PCI DSS uas yuav tsum ua raws, cov kev cai hloov mus rau lwm txoj kev thiab txoj kev npaj uas tau txais kev pom zoo.
5. Xaiv txoj kev npaj: tej zaum yuav yog ib qho kev daws teeb meem MPoC uas tsim nyog, ib lub tshuab them nyiaj tshwj xeeb, lossis lwm txoj kev uas tsis tas sau PIN rau hauv COTS. Tsis txhob muab ntau yam khoom sib txuas ua ke ntawm koj tus kheej thiab suav tias yog ib qho kev daws teeb meem uas PCI SSC tau pom zoo lawm.
6. Kuaj ua ntej hloov mus rau lwm txoj kev: siv ib puag ncig lossis txheej txheem uas tus neeg muab kev pabcuam tau tso cai kom kuaj kev lag luam chip, kev lag luam tsis kov yog tias muaj kev txhawb nqa, kev xa nyiaj rov qab, thaum tsis muaj network, kev hloov kho app, kev xauv lub cuab yeej thiab txoj kev lis haujlwm thaum lub cuab yeej ploj.
7. Khaws cov ntaub ntawv: khaws listing, ntawv cog lus, daim ntawv lees paub los ntawm tus neeg them nyiaj, ntaub ntawv sau tseg txog kev kuaj, kev teeb tsa cuab yeej, kev faib lub luag haujlwm thiab txoj kev npaj rov qab siv tau.

Tshem tawm qhov kev daws teeb meem qub tsuas yog tom qab qhov kev xaiv tshiab tau kuaj tiav, tau txais kev pom zoo los ntawm cov tog neeg cuam tshuam thiab muaj ib txoj kev them nyiajสำรอง. Yog tias listing tam sim no tseem siv tau ntev, lub lag luam yuav txuas ntxiv siv tau raws li kev tswj hwm, tab sis tseem yuav tsum teeb ib hnub tshuaj xyuas ua ntej hnub tas siv tiag.

Kev kuaj tiav: tus neeg saib xyuas yuav tsum teb tau peb lo lus nug no: qhov kev daws teeb meem tam sim no tseem siv tau txog hnub twg; leej twg ris lub luag haujlwm rau txhua feem ntawm PCI DSS; thiab yog tias tsis tau txais kev txhawb nqa ntxiv lawm, lub khw yuav hloov mus rau txoj kev twg kom tsis txhob cuam tshuam kev them nyiaj.

Ceeb toom txog kev ruaj ntseg: tsis txhob siv tus neeg ua haujlwm lub xov tooj ntiag tug ua lub cuab yeej them nyiaj yog tias lub lag luam tswj tsis tau nws txoj kev teeb tsa, apps, kev tso cai nkag thiab rab peev xwm lwv cov ntaub ntawv nyob deb. PCI Mobile Payment Acceptance Security Guidelines for Merchants muab cov lus qhia txog kev tiv thaiv cov cuab yeej thiab cov kev daws teeb meem raws li lub luag haujlwm ntawm lub khw thiab tus neeg muab kev pabcuam; daim ntawv no tsis hloov PCI DSS.

Yog tias kev hloov mus rau lwm txoj kev ua tsis tiav, rov qab siv qhov kev teeb tsa qub tsuas yog thaum listing thiab daim ntawv cog lus ntawm qhov kev teeb tsa ntawd tseem siv tau. Sau tseg qhov teeb meem, qhib daim ntawv thov kev pab nrog tus neeg muab kev pabcuam thiab siv txoj kev them nyiajสำรอง uas lub txhab nyiaj them nyiaj lossis tus payment acquirer tau pom zoo.

Cov ntaub ntawv siv

• PCI Security Standards Council Bulletin: Announcement of Sunset Periods for the PCI SPoC and PCI CPoC Standards
• Software-based PIN Entry on COTS (SPoC)
• New FAQs on Software-based PIN Entry on COTS
• Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?
• Do small merchants with limited transaction volumes need comply with PCI DSS?
• PCI Mobile Payment Acceptance Security Guidelines for Merchants