The PCI Security Standards Council has launched a 30-day request for comments period from February 13 to March 16, 2026, for the draft PCI Card Production and Provisioning Physical and Logical Security Standards v3.0.1. Eligible PCI SSC stakeholders are invited to review and provide feedback on the updated standards that govern physical and digital security requirements for payment card manufacturing and provisioning processes.
The Payment Card Industry Security Standards Council (PCI SSC) has announced a 30-day request for comments (RFC) period for the draft PCI Card Production and Provisioning Physical and Logical Security Standards version 3.0.1, running from February 13 through March 16, 2026.
The PCI Card Production and Provisioning Physical and Logical Security Standards establish comprehensive security requirements for organizations involved in the manufacturing, personalization, and provisioning of payment cards. These standards address both physical security measures for card production facilities and logical security controls for digital card provisioning processes.
The standards cover critical areas including:
The updated standards will impact several key stakeholder groups in the payment card ecosystem:
Card Manufacturers and Personalizers: Organizations that produce physical payment cards must comply with stringent physical security requirements, including secure facilities, controlled access, and tamper-evident processes.
Digital Card Provisioning Services: Companies providing mobile wallet provisioning and digital card services must implement robust logical security controls to protect sensitive authentication data and cryptographic keys.
Technology Service Providers: Vendors supporting card production and provisioning operations through software, hardware, or services must meet applicable security requirements.
The version 3.0.1 update likely addresses emerging threats and incorporates lessons learned from the implementation of previous versions. Organizations should expect potential changes in:
Enhanced Security Controls: Updates may introduce more stringent requirements for protecting sensitive authentication data and improving incident detection capabilities.
Supply Chain Security: Given increasing focus on third-party risk management, the update may include expanded vendor oversight and supply chain security requirements.
Digital Transformation Alignment: As payment methods evolve toward digital-first experiences, the standards may better address cloud-based provisioning and mobile payment technologies.
Eligible Stakeholders: PCI SSC participating organizations, qualified security assessors, and other authorized stakeholders should actively participate in the RFC process. This is a critical opportunity to influence standards that will govern operations for years to come.
Review and Feedback: Organizations should thoroughly review the draft standards, focusing on areas that directly impact their operations. Feedback should be specific, actionable, and supported by business justification.
Gap Analysis Preparation: Even non-participating organizations should begin preliminary gap analysis against current compliance posture, as the final standards will eventually require implementation.
Stakeholder Engagement: Internal teams including security, compliance, operations, and legal should collaborate to provide comprehensive feedback that addresses technical feasibility and business impact.
While the RFC period concludes on March 16, 2026, organizations should anticipate additional time for PCI SSC to incorporate feedback and publish final standards. Typically, implementation timelines provide 12-18 months for organizations to achieve compliance with new requirements.
The proactive engagement during the RFC period not only helps shape industry standards but also provides early insight into upcoming compliance requirements, enabling better strategic planning and resource allocation.
Only eligible PCI SSC stakeholders, including participating organizations, qualified security assessors, and other authorized entities can participate in the RFC process.
The request for comments period runs from February 13, 2026, through March 16, 2026, providing a 30-day window for stakeholder feedback.
Card manufacturers, personalizers, digital card provisioning services, and technology service providers supporting card production and provisioning operations must comply with these standards.
PCI SSC typically provides 12-18 months implementation timelines after final standards publication, allowing organizations time to achieve compliance with new requirements.
The standards cover physical facility security, personnel controls, secure manufacturing processes, digital key management, cryptographic operations, incident response, and vendor security requirements.
PoliWriter creates all the policies and documentation you need for compliance, customized to your organization. AI-powered, audit-ready, hours not months.
Get Started Free