ISO 13491-1:2016

Overview - What ISO 13491-1:2016 covers

ISO 13491-1:2016 defines the security characteristics and evaluation methods for secure cryptographic devices (SCDs) used in the retail financial services environment. It addresses both the operational characteristics of SCDs and the management of devices across their life cycle, and provides guidance (Annex A) on methodologies to verify compliance. The standard is based on cryptographic processes referenced in ISO 9564, ISO 16609, and ISO 11568 and is complemented by ISO 13491-2, which supplies compliance checklists.

Key topics and technical requirements

ISO 13491-1 focuses on measurable security properties and management controls rather than implementation details. Major technical topics include:

• Attack scenarios - identification of threats such as penetration, monitoring, manipulation, modification and substitution.
• Physical security requirements - device construction and environmental protection to resist tampering.
• Tamper properties:
  • Tamper-evident: indicators that reveal unauthorized access.
  • Tamper-resistant: design measures that increase effort needed to attack.
  • Tamper-responsive: mechanisms that detect tampering and protect or erase sensitive material.
• Logical security requirements - cryptographic and administrative controls, including:
  • Dual control and separation of duties.
  • Unique key per device and proper handling of cryptographic keys.
  • Device software authentication and assurance of genuine devices.
  • Protection of sensitive device states and support for multiple cryptographic relationships.
• Device management and life cycle - requirements and protection methods across phases such as manufacturing, commissioning (initial key loading), active/inactive operation, repair, decommissioning and destruction.
• Accountability, audit and control - traceability and processes to detect and respond to compromise.
• Evaluation methods - informative guidance in Annex A to help verify compliance (note: ISO 13491-2 provides formal checklists).

Important exclusion: ISO 13491-1 does not address denial-of-service (DoS) issues.

Practical applications and who uses this standard

ISO 13491-1 is used to design, qualify and manage SCDs in retail payment systems. Typical users include:

• Device manufacturers (PIN pads, secure modules, payment terminals)
• Payment processors, banks and card issuers
• Security architects and integrators implementing payment solutions
• Certifiers, auditors and conformity assessment bodies
• Regulators and risk managers assessing payment-device controls

Adoption helps reduce fraud, protect PINs, MACs, cryptographic keys and other sensitive data, and supports demonstrable compliance during procurement and certification.

Related standards

• ISO 13491-2 - Security compliance checklists for retail SCDs
• ISO 9564 - PIN management and security
• ISO 16609 - (cryptographic processes referenced)
• ISO 11568 series - Key management for devices in retail financial services

Keywords: ISO 13491-1, secure cryptographic devices, SCDs, retail financial services, tamper-evident, tamper-resistant, tamper-responsive, device life cycle, cryptographic key management, evaluation methods.