ISO 13491-2:2023 gives security-compliance checklists for cryptographic devices used in financial transactions. It turns Part 1's concepts and requirements into structured assessment criteria, helping evaluators examine device protections consistently against the security framework.
TL;DR:
- ISO 13491-2:2023 supplies security-compliance checklists for cryptographic devices.
- It concerns devices implementing specified financial cryptographic processes.
- Payment IC cards leave its scope after issuance.
Summary
Evaluation checklists
ISO 13491-2:2023 defines checklists for evaluating secure cryptographic devices in financial-services environments. It complements device-security concepts with an assessment-oriented structure.
Referenced processes
The public scope identifies devices incorporating cryptographic processes specified in ISO 9564-1, ISO 9564-2, ISO 16609 and ISO 11568. The referenced processes determine the relevant assessment context.
IC-card boundary
Integrated-circuit payment cards are within the stated requirements only until issuance. After that point, the abstract treats them as personal devices outside this document’s scope. That timing is material when assessing a card-production or personalisation environment.
Edition and lifecycle
ISO lists edition 5, published in January 2023, with a current stage of to be revised. That stage does not mean the publication has already been withdrawn. The public abstract identifies applicability; the licensed checklists are needed for detailed evaluation.
Keywords
- Security Checklists
- Cryptographic Devices
- Device Evaluation
- PIN Processing
- Message Authentication
- Key Management
- IC Cards
- Pre-Issuance
- Financial Security
- Compliance Assessment