Point of Sale (POS)
PCIComplianceHubLast updated
A merchant's checkout system: the till or electronic cash register, the terminal or PIN pad that reads the customer's card, and the software that ties them together to take the payment. In PCI DSS the POS is that whole system, while the POI is only the card-reading device inside it; Requirement 9.5.1 protects that device against tampering and substitution.
Applies to. Applies to merchants taking card-present payments. The parts of the POS that store, process or transmit account data are system components in the Cardholder Data Environment and carry the requirements that apply to any in-scope component; the card-reading devices inside the POS also carry the device list, inspection and training obligations of 9.5.1. Where a third party hosts or manages the POS on the merchant's behalf, 12.8.2 requires a written agreement in which that provider acknowledges responsibility for the account data it handles.
Example. A hardware shop runs a till application on a counter PC with a PIN pad plugged into it for chip and contactless payments. The PC, the till software, the PIN pad and the link to the payment provider together make up the POS system; the PIN pad on its own is the POI, and it is the item that appears on the 9.5.1.1 device list.
Limits. POS is broader than POI: the 9.5.1.1 device list records card-reading devices, not every till or back-office PC, while the rest of the POS is assessed as ordinary system components. POS is a card-present channel; a virtual payment terminal used to key in mail or telephone orders, or a payment page on a website, is a different channel with different requirements. The label also settles nothing about scope on its own: whether a POS component is in the Cardholder Data Environment depends on whether it stores, processes or transmits account data or could affect the security of the environment, not on what it is called.