ISO/IEC 7816-9:2017

Overview

ISO/IEC 7816-9:2017 - "Identification cards - Integrated circuit cards - Part 9: Commands for card management" defines interindustry commands for card, file and structure management on integrated circuit (smart) cards. The standard covers commands that manage data objects and security objects across the entire card life cycle (creation, initialization, operation, deactivation, termination). It applies to command-level interchange between the outside world and the card, but is not prescriptive about internal card implementation.

Key topics and requirements

• Life cycle status (LCS): Defines primary life-cycle states (creation, initialization, operational - activated/deactivated - termination) and rules for LCS inheritance, evaluation and transitions. LCS determines which operations and security attributes apply to an object or the card.
• Card and object management commands: Standardizes interindustry commands such as create file, delete, deactivate, activate, terminate, manage data, create, terminate card usage, and import card secret. These commands cover pre-issuance, operational use and post-expiry actions.
• Security objects and secure messaging: Addresses management of security objects (standalone objects endorsing security handling) and use of secure messaging for cryptographic protection of command‑response pairs.
• Command semantics and parameter harmonization: The 2017 edition harmonized certain command parameters (e.g., a generic P1 parameter for several commands) and introduced templates (e.g., ‘AE’) for configuring command-dependent LCS transitions. It also clarifies legacy vs. generic command behavior.
• Backward compatibility and deprecation notes: Some commands (e.g., manage data/delete data for DO) are reserved or flagged as likely deprecated in future revisions, preserving legacy behavior while guiding modernization.

Applications and who uses it

ISO/IEC 7816-9:2017 is essential for anyone designing or operating smart-card ecosystems:

• Smart card OS and firmware developers - implement standardized management commands and LCS handling for interoperability.
• Card manufacturers and personalization bureaus - support life-cycle operations such as issuance, personalization, activation/deactivation and secure deletion.
• Systems integrators and solution architects - design back-end systems that interact with cards for provisioning, update, and lifecycle control.
• Security architects and certification bodies - validate that card management and secure messaging follow interindustry norms.
• Issuers (banks, governments, telecoms) - implement card issuance, lifecycle transitions and post-expiry handling consistently across deployments.

Related standards

• ISO/IEC 7816-4: Organization, security and commands for interchange (normative reference)
• Other parts of the ISO/IEC 7816 series relevant to integrated circuit cards: 7816‑1, 7816‑2, 7816‑3, 7816‑8, 7816‑10, 7816‑11, 7816‑12, 7816‑13, 7816‑15

ISO/IEC 7816-9:2017 is a practical, interoperable foundation for standardized card management commands, life‑cycle control and secure handling of data and security objects in smart-card deployments.