Trusted Platform Module (TPM)
PCIComplianceHubLast updated
A hardware component that provides cryptographic functions and secure storage for sensitive data, such as encryption keys. TPMs can help organizations enhance the security of their cardholder data environment and maintain PCI DSS compliance.
Applies to. PCI DSS v4.0.1 does not name the TPM. Requirement 3 allows keys protecting stored account data to be held inside a secure cryptographic device, naming HSMs and PTS-approved point-of-interaction devices as examples, and an entity that wants to count a TPM as one has to justify it, since a TPM is built to protect a small number of platform keys and is not part of the Council's PTS HSM programme. The other place it appears is disk encryption: a TPM that unlocks an encrypted disk automatically at boot is a clear illustration of why Requirement 3 does not accept disk-level encryption on its own for PAN on non-removable storage, since once the system is running the data is readable to anyone with access to it.