Firmware
PCIComplianceHubLast updated
Software that is embedded within a hardware device, such as a router or payment terminal, to provide low-level control and management of the device's functions and operations.
Applies to. PCI DSS v4.0.1 does not name firmware in its requirement text. It is covered as the third-party software running on a system component: the vulnerability identification process under 6.3.1 must cover third-party software, 2.3.1 asks that wireless vendor defaults on access points are changed or confirmed secure at installation, and the guidance to 12.3.4 says the annual review of hardware and software technologies should include reviewing firmware versions. For payment terminals, the PTS POI approval listing records the approved firmware version alongside the hardware version, which is how an entity checks that a device is running approved firmware.
Limits. Firmware is not exempt from vulnerability management because it ships inside hardware; the requirement to identify and rank vulnerabilities covers third-party software without excluding embedded software.
In PCI DSS v4.0.1. 12.3.4