ISO 18960:2025

Overview

ISO 18960:2025 - "Security controls and implementation for third party payment service providers - Guidance and requirements" is an ISO standard that provides requirements and practical guidance on security controls for third‑party payment service providers (TPPSPs). Published in 2025, it addresses organization‑wide security across the lifecycle of payment services: development, testing, installation, operation and audit. The standard is focused on protecting customer data (including PII) and preserving payment service integrity in fintech and payment ecosystems.

Key topics and technical requirements

ISO 18960 structures controls into three main categories and details concrete control areas:

• Security governance controls

  • Service security policies (information security, PII protection, user permissions, complaint handling)
  • Roles and responsibilities and TPPSP security organization
  • Risk management (process, assessment and treatment)
  • Documentation, logging, monitoring, review and continual improvement

• Cross‑functional controls

  • Asset management and data security
  • Access management (administrators, terminals, privileged programs)
  • Supplier security and cloud service use
  • TPP service continuity and incident logging

• Function‑specific controls

  • Vulnerability and incident response management (procedures, training, documentation)
  • Human security (security training, NDAs, segregation of duties, access changes)
  • Physical security (secure areas, access control)
  • System security: server, network and application security (malware prevention, patch management, DMZ, private IPs, secure communications, web/mobile app security, data sanitization)

The standard emphasizes logging, audits, secure development lifecycle practices, and specific operational safeguards for servers, networks and TPP applications.

Practical applications

ISO 18960 is intended to be used to:

• Develop or strengthen an information security program for TPPSPs and fintechs
• Define security policies, governance and role responsibilities
• Guide secure design and operation of payment applications (web & mobile)
• Specify supplier and cloud security requirements in vendor contracts
• Implement vulnerability management, incident response and business continuity
• Support internal and external audits, regulatory compliance assessments and risk treatment plans

Who should use this standard

• Third‑party payment service providers (TPPSPs) and fintech companies
• Banks and payment institutions using or onboarding TPPSPs
• Security architects, compliance teams, and operational IT staff
• Auditors, regulators and risk managers evaluating payment security controls
• Cloud and supplier risk teams integrating payment services

Related standards

• ISO 23195 (security objectives for TPPSP systems) - Annex A of ISO 18960 maps controls to ISO 23195 objectives
• ISO/IEC 27002 - complements ISO 18960 with general information security controls; ISO 18960 tailors controls for the payment ecosystem

Keywords: ISO 18960:2025, TPPSP security, third‑party payment service providers, payment security, PII protection, vulnerability management, access management, supplier security.