PCI DSS Compliance for Payment-Enabled Kiosks
When digital signage kiosks accept credit card payments, they fall under PCI DSS (Payment Card Industry Data Security Standard) requirements. Non-compliance can result in fines up to $500,000 per incident, loss of card processing privileges, and liability for fraud losses. This guide covers compliance requirements for self-service payment kiosks.
Understanding PCI DSS for Kiosks
What Triggers PCI DSS Requirements?
Your kiosk requires PCI DSS compliance if it:
- Accepts credit/debit card payments
- Transmits cardholder data
- Stores any payment information
- Connects to payment processing systems
┌─────────────────────────────────────────────────────────────────────────┐
│ PCI DSS APPLICABILITY │
├─────────────────────────────────────────────────────────────────────────┤
│ │
│ KIOSK ACCEPTS PAYMENT? │
│ │ │
│ ┌──────┴──────┐ │
│ ▼ ▼ │
│ YES NO │
│ │ │ │
│ │ ▼ │
│ │ PCI DSS NOT REQUIRED │
│ │ (for this system) │
│ │ │
│ ▼ │
│ HOW DOES KIOSK HANDLE CARD DATA? │
│ │ │
│ ┌────────┼────────┬────────────────┐ │
│ ▼ ▼ ▼ ▼ │
│ STORES PROCESSES TRANSMITS REDIRECTS TO │
│ DATA DATA DATA THIRD PARTY │
│ │ │ │ │ │
│ ▼ ▼ ▼ ▼ │
│ FULL PCI FULL PCI FULL PCI REDUCED SCOPE │
│ (Highest) (High) (High) (SAQ A or A-EP) │
│ │
└─────────────────────────────────────────────────────────────────────────┘
PCI DSS Compliance Levels
| Level | Annual Transactions | Validation Requirements |
|---|---|---|
| 1 | >6 million | Annual QSA audit, quarterly scans |
| 2 | 1-6 million | Annual SAQ, quarterly scans |
| 3 | 20,000-1 million | Annual SAQ, quarterly scans |
| 4 | <20,000 | Annual SAQ, quarterly scans recommended |
Self-Assessment Questionnaires (SAQ) for Kiosks
| SAQ Type | Kiosk Configuration | Scope |
|---|---|---|
| SAQ B-IP | Standalone payment terminal, network connected | 82 requirements |
| SAQ C | Payment application on kiosk, no cardholder storage | 160 requirements |
| SAQ C-VT | Virtual terminal accessed via browser | 79 requirements |
| SAQ D | All other scenarios | Full 300+ requirements |
The 12 PCI DSS Requirements for Kiosks
Requirement 1: Firewall Configuration
Protect kiosk networks with properly configured firewalls.
┌─────────────────────────────────────────────────────────────────┐
│ KIOSK NETWORK SEGMENTATION │
├─────────────────────────────────────────────────────────────────┤
│ │
│ INTERNET │
│ │ │
│ ▼ │
│ ┌──────────────────┐ │
│ │ FIREWALL │ ◄── Stateful inspection │
│ │ │ ◄── Deny all by default │
│ └────────┬─────────┘ │
│ │ │
│ ┌────────┴──────────────────────────────┐ │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ CORPORATE │ │ PAYMENT │ │
│ │ NETWORK │ SEGMENTED │ KIOSK │ │
│ │ │◄───────────────────│ NETWORK │ │
│ │ • Email │ (No direct │ │ │
│ │ • File share │ access) │ • Kiosks │ │
│ │ • Apps │ │ • Payment │ │
│ └──────────────┘ │ processor │ │
│ └──────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Kiosk Firewall Requirements:
- Segment payment kiosks from other networks
- Restrict inbound connections to necessary only
- Document all allowed traffic flows
- Review firewall rules every 6 months
Requirement 2: Secure Configuration
Remove defaults, harden kiosk systems.
| Component | Action Required |
|---|---|
| OS passwords | Change all defaults |
| Admin accounts | Unique credentials per kiosk |
| Unnecessary services | Disable/remove |
| USB ports | Disable in BIOS |
| Wireless | Disable if not used |
| Remote access | Secure or disable |
Kiosk Hardening Checklist:
- Default passwords changed
- Unnecessary software removed
- Auto-login disabled
- Screen lock enabled
- Boot from USB disabled
- BIOS password set
- Automatic updates configured
Requirement 3: Protect Stored Data
Minimize and protect cardholder data storage.
Best Practice: Don't Store Card Data
PREFERRED ARCHITECTURE (P2PE):
Customer Card ──► P2PE Terminal ──► Encrypted to Processor
│
│ Only encrypted data
│ passes through kiosk
▼
Kiosk System
(No card data stored)
If storage is unavoidable:
- Encrypt with AES-256
- Implement key management
- Mask PAN when displayed (show only last 4)
- Never store CVV/CVC
- Define retention limits
- Secure deletion procedures
Requirement 4: Encrypt Transmission
Encrypt cardholder data across networks.
| Connection | Encryption Required |
|---|---|
| Kiosk to processor | TLS 1.2+ mandatory |
| Kiosk to management | TLS 1.2+ or VPN |
| Wireless (if used) | WPA3 or WPA2-Enterprise |
| Internal network | TLS recommended |
Requirement 5: Anti-Malware
Protect kiosks from malicious software.
- Install enterprise anti-malware
- Enable real-time scanning
- Update signatures automatically
- Scan all removable media
- Log all malware events
- Application whitelisting recommended
Requirement 6: Secure Development
Ensure payment applications are secure.
For Custom Kiosk Applications:
- Follow secure coding guidelines (OWASP)
- Conduct code reviews
- Test for common vulnerabilities
- Maintain change control process
- Apply security patches promptly
For Third-Party Applications:
- Use PA-DSS validated applications
- Verify vendor security practices
- Keep applications updated
Requirement 7: Access Control
Restrict access to cardholder data.
┌─────────────────────────────────────────────────────────────────┐
│ ACCESS CONTROL FOR KIOSKS │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ROLE ACCESS LEVEL │
│ ──────────────────────────────────────────────────────── │
│ Customer Touch screen interface only │
│ Field Technician Maintenance mode (no payment data) │
│ Kiosk Administrator System configuration (encrypted) │
│ Payment Administrator Payment config (need-to-know) │
│ Security Administrator Audit logs, security settings │
│ │
│ PRINCIPLE: Minimum necessary access │
│ │
└─────────────────────────────────────────────────────────────────┘
Requirement 8: User Authentication
Unique IDs for all administrative access.
| Requirement | Implementation |
|---|---|
| Unique user IDs | No shared accounts |
| Password complexity | 12+ chars, mixed case, numbers |
| Password expiration | 90 days maximum |
| Account lockout | 6 failed attempts |
| Session timeout | 15 minutes inactivity |
| MFA | Required for remote access |
Requirement 9: Physical Security
Restrict physical access to kiosks.
Kiosk Physical Security:
┌─────────────────────────────────────────────────────────────────┐
│ KIOSK PHYSICAL SECURITY │
├─────────────────────────────────────────────────────────────────┤
│ │
│ EXTERNAL PROTECTION │
│ • Tamper-resistant enclosure │
│ • Keyed locks (restricted key) │
│ • Tamper-evident seals │
│ • Security cameras covering kiosk │
│ • Well-lit location │
│ │
│ INTERNAL PROTECTION │
│ • Secure mounting (bolted down) │
│ • Internal tamper switches │
│ • No exposed ports │
│ • Payment terminal secured │
│ • Cable management (no exposed wires) │
│ │
│ INSPECTION PROTOCOL │
│ • Daily visual inspection │
│ • Check for skimmers/overlays │
│ • Verify tamper seals │
│ • Document inspections │
│ │
└─────────────────────────────────────────────────────────────────┘
Requirement 10: Logging and Monitoring
Track all access to payment systems.
Required Logs:
- All access to cardholder data
- All administrative actions
- Access to audit trails
- Invalid access attempts
- Authentication events
- System events (start, stop, errors)
Log Retention: Minimum 1 year, 3 months immediately available
Requirement 11: Security Testing
Regularly test security systems.
| Test | Frequency | Scope |
|---|---|---|
| Vulnerability scan | Quarterly + after changes | All kiosks |
| Penetration test | Annual + after major changes | Payment systems |
| Wireless scan | Quarterly | All locations |
| IDS/IPS monitoring | Continuous | Network traffic |
Requirement 12: Security Policies
Maintain comprehensive security policies.
Required documentation:
- Information security policy
- Acceptable use policy
- Incident response plan
- Kiosk security procedures
- Vendor management policy
- Employee training records
Point-to-Point Encryption (P2PE)
Why P2PE Reduces Scope
P2PE-validated solutions can dramatically reduce PCI scope:
WITHOUT P2PE:
┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐
│ Card │───►│ Kiosk │───►│ Network │───►│Processor│
│ Reader │ │ System │ │ │ │ │
└─────────┘ └─────────┘ └─────────┘ └─────────┘
│
Card data in
clear - ALL
components
in PCI scope
WITH P2PE:
┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐
│ P2PE │═══►│ Kiosk │═══►│ Network │═══►│Processor│
│ Terminal│ │ System │ │ │ │ │
└─────────┘ └─────────┘ └─────────┘ └─────────┘
│ │ │
Encrypted Encrypted Encrypted
at source passes through in transit
(out of scope) (reduced scope)
P2PE Benefits for Kiosks
| Benefit | Impact |
|---|---|
| Reduced SAQ requirements | SAQ P2PE (33 questions vs 300+) |
| Lower compliance costs | Less testing, fewer controls |
| Reduced breach risk | Card data never exposed |
| Simplified architecture | No encryption key management |
| Faster deployment | Pre-validated solution |
Implementing P2PE
- Select a PCI P2PE-validated payment terminal
- Use a P2PE-validated payment application
- Integrate terminal with kiosk application
- Follow P2PE Instruction Manual (PIM)
- Validate with your QSA or ISA
Kiosk Architecture Best Practices
Secure Kiosk Architecture
┌─────────────────────────────────────────────────────────────────────────┐
│ SECURE KIOSK ARCHITECTURE │
├─────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ KIOSK UNIT │ │
│ │ │ │
│ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │
│ │ │ DISPLAY │ │ KIOSK │ │ P2PE │ │ │
│ │ │ (Touch) │───►│ APP │◄───│ TERMINAL │ │ │
│ │ │ │ │ │ │ │ │ │
│ │ │ • UI only │ │ • Business │ │ • Card read │ │ │
│ │ │ • No card │ │ logic │ │ • Encryption │ │ │
│ │ │ data │ │ • No card │ │ • Tamper │ │ │
│ │ │ │ │ data │ │ protection │ │ │
│ │ └──────────────┘ └──────┬───────┘ └──────┬───────┘ │ │
│ │ │ │ │ │
│ └──────────────────────────────┼───────────────────┼──────────────┘ │
│ │ │ │
│ ┌─────────────┴───────────────────┴────────┐ │
│ │ NETWORK │ │
│ │ (Encrypted, segmented, monitored) │ │
│ └─────────────────────┬────────────────────┘ │
│ │ │
│ ┌─────────────────────┴────────────────────┐ │
│ ▼ ▼ │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ KIOSK │ │ PAYMENT │ │
│ │ MANAGEMENT │ │ PROCESSOR │ │
│ │ │ │ │ │
│ │ • Monitoring │ │ • Decrypt │ │
│ │ • Updates │ │ • Authorize │ │
│ │ • Config │ │ • Settle │ │
│ └──────────────┘ └──────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────┘
Network Segmentation
| Zone | Components | Allowed Traffic |
|---|---|---|
| Payment Zone | Kiosks, terminals | To processor only |
| Management Zone | Kiosk management servers | To payment zone (limited) |
| Corporate Zone | Business systems | No payment zone access |
| Internet Zone | Public access | Via firewall only |
Incident Response for Kiosks
Payment Security Incident Response
┌─────────────────────────────────────────────────────────────────┐
│ PAYMENT INCIDENT RESPONSE PROCEDURE │
├─────────────────────────────────────────────────────────────────┤
│ │
│ 1. DETECTION │
│ • Monitoring alert │
│ • Customer complaint │
│ • Physical tampering discovered │
│ • Suspicious transactions │
│ │
│ 2. CONTAINMENT (Within 1 hour) │
│ • Disable affected kiosk(s) │
│ • Preserve evidence (logs, images) │
│ • Isolate from network if needed │
│ • Do not power off (preserve memory) │
│ │
│ 3. NOTIFICATION (Within 24 hours) │
│ • Internal security team │
│ • Payment processor │
│ • Card brands (if required) │
│ • Legal counsel │
│ • Law enforcement (if criminal) │
│ │
│ 4. INVESTIGATION │
│ • Forensic analysis │
│ • Determine scope │
│ • Identify root cause │
│ • Document findings │
│ │
│ 5. REMEDIATION │
│ • Fix vulnerability │
│ • Update procedures │
│ • Retrain staff │
│ • Enhanced monitoring │
│ │
│ 6. REPORTING │
│ • Incident report │
│ • Lessons learned │
│ • Compliance notification │
│ │
└─────────────────────────────────────────────────────────────────┘
Common Kiosk Attack Vectors
| Attack | Detection | Prevention |
|---|---|---|
| Card skimmer | Visual inspection, tamper alerts | Tamper-resistant design, daily checks |
| Malware | Anti-malware alerts, behavior anomaly | Application whitelisting, updates |
| Network attack | IDS alerts, traffic anomaly | Segmentation, encryption |
| Physical breach | Tamper switches, camera | Secure enclosure, alarms |
| Social engineering | Training, awareness | Policies, verification procedures |
Compliance Checklist
PCI DSS Kiosk Compliance Checklist
Network Security:
- Kiosks on segmented network
- Firewall protecting payment network
- All traffic encrypted (TLS 1.2+)
- Wireless secured (WPA3/WPA2-Enterprise)
System Security:
- Default passwords changed
- Unnecessary services disabled
- Anti-malware installed and updated
- Security patches applied
- USB/external ports disabled
Physical Security:
- Tamper-resistant enclosure
- Tamper-evident seals
- Daily inspection procedure
- Security camera coverage
- Secure key management
Access Control:
- Unique user accounts
- Strong password policy
- MFA for remote access
- Role-based permissions
- Access review process
Monitoring:
- Logging enabled
- Logs centrally collected
- 1-year retention
- Alert monitoring
- Incident response plan
Documentation:
- Security policies
- Network diagram
- Data flow diagram
- Kiosk inventory
- Training records
Frequently Asked Questions
Try it on your own screens, free
DigitalSignage.com, which publishes this guide, runs a permanent free plan: the first 3 screens are free forever (no credit card, no ads, no time limit), then from $3 per screen per month with volume pricing via a public calculator. The free SignPlayer runs on Windows, Mac, Android and Android TV, Chrome OS, Raspberry Pi, iPad or any modern web browser. Start free · 2026 pricing
Next Steps
- Kiosk Deployment Guide - Kiosk solutions
- Self-Service Ordering Kiosks - QSR kiosks
- Security Best Practices - System hardening
- HIPAA Compliance - Healthcare requirements
This guide is for informational purposes and does not constitute legal or compliance advice. Consult with a Qualified Security Assessor (QSA) for your specific PCI DSS compliance requirements. This guide is maintained by MediaSignage, pioneers of digital signage technology since 2006.