ISO 13491-1:2024

Overview

ISO 13491-1:2024 - Financial services - Secure cryptographic devices (retail) - Part 1: Concepts and requirements defines security characteristics and lifecycle management for secure cryptographic devices (SCDs) used in retail financial services. This fourth edition (revising ISO 13491-1:2016) updates device class definitions and life‑cycle guidance. It is intended for devices that implement cryptographic processes referenced in ISO 9564, ISO 16609 and ISO 11568 and covers both operational characteristics and management throughout all life‑cycle stages. The standard explicitly excludes denial‑of‑service issues and software multi‑party computation (MPC) implementations sometimes described as “soft HSMs.”

Key topics and requirements

• Device concepts and types
  • Definitions for SCDs, hardware security modules (HSMs), key loading devices and hardware management devices.
• Attack scenarios
  • Threat modelling for penetration, monitoring, manipulation, modification and substitution attacks.
• Defence measures
  • Requirements for device characteristics, management practices and environmental controls to mitigate attacks.
• Physical security
  • Tamper‑evident, tamper‑resistant and tamper‑responsive behaviour specifications (detection, resistance and response).
• Logical security
  • Dual control, unique key per device, secure device software authentication, handling of sensitive device states, and management of multiple cryptographic relationships.
• Life‑cycle management
  • Protection requirements and methods across manufacturing, commissioning (initial key loading), active/inactive operation, repair, decommissioning and destruction phases.
• Accountability and audit
  • Principles for device management, auditability and control to ensure traceability and compliance.

Practical applications and who uses this standard

ISO 13491-1:2024 is directly relevant to organizations involved in retail payment security and cryptographic device deployment:

• Banks and payment processors securing PINs, transaction keys and payment credentials.
• HSM and SCD manufacturers designing devices to meet retail financial security expectations.
• Key management and key loading service providers implementing secure commissioning and lifecycle controls.
• Security architects, auditors and compliance teams evaluating device security, tamper protections and lifecycle procedures.
• System integrators and card personalization centers handling device commissioning, repair and decommissioning.

Adopting ISO 13491-1 helps ensure robust, auditable cryptographic device security across the retail payment ecosystem and supports interoperability with related ISO payment standards.

Related standards

• ISO 9564 series (PIN management)
• ISO 16609 (PIN interchange and related processes)
• ISO 11568 (Key management for financial services)
• Other parts of the ISO 13491 series (device-specific parts and profiles)

For implementation details, procurement or certification, consult the full ISO 13491-1:2024 document through your national standards body or ISO.