Key Injection Facility (KIF) Assessments

A key injection facility (KIF) is a secure environment where cryptographic keys are loaded into PIN-accepting devices, such as POS PIN pads, unattended terminals and ATMs, before they go into service. If you inject the keys acquirers use to protect PIN data, your facility is assessed against Normative Annex B of the PCI PIN Security Requirements by a Qualified PIN Assessor (QPA).

Sovereign Secure is a PCI SSC-approved QPA company, as well as a QSA and Card Production Security Assessor (CPSA). We assess third-party and in-house KIFs, review remote key injection platforms under Annex A, and help new facilities prepare. KIF work sits within our PCI PIN security assessments service, part of our PCI compliance services.

Who needs a key injection facility assessment?

Anyone loading acquirer keys (PIN encryption keys, terminal master keys or initial DUKPT keys) into POI devices for brands that require PCI PIN compliance.

Manufacturer keys are out of scope; they fall under the PTS POI and HSM standards. The payment brands, networks and acquirers, not the PCI Security Standards Council, decide who must validate and how often, and US debit networks also expect TR-39 audits.

Key injection facility requirements under PCI PIN Annex B

Annex B applies the PIN standard’s seven control objectives to key injection, using the same requirement numbers, and adds KIF-specific controls:

The KIF secure room (Requirement 32-9)

A secure room is required whenever clear-text keys or components exist outside a secure cryptographic device during injection. PCI SSC’s technical FAQs describe what assessors check:

• solid walls extended to the real floor and ceiling (wire mesh only above false ceilings or below false floors, or a specified steel-cage design);
• windows locked, alarmed and shielded from observation;
• electronic access control enforcing dual access and anti-pass-back, with an alarm if one person is alone inside for more than 30 seconds;
• CCTV recording all activity, monitored 24/7, covering the door, safes and equipment but never PIN pads or keyboards;
• CCTV storage in a separate location secure-room staff cannot reach, with images kept for at least 45 days.

PCI PIN deadlines that affect KIFs in 2026

Clear-text injection into POI v4 and earlier devices stays acceptable until a payment brand requires their retirement. Loading only counts as encrypted if keys never appear in the clear outside the KLD and the POI device, so TLS qualifies only when it terminates inside both.

What is remote key injection?

Remote key injection loads initial keys into a POI device over a network, not by cable from a key loading device. The key distribution host (KDH) and device hold certificates under the same root certification authority, and the symmetric key travels encrypted. PCI SSC cites ANSI X9 TR-34 as a compliant method.

RKI moves the control burden rather than removing it: the CA needs its own physically secure, dedicated room, and the PKI must stop devices being hijacked by another host. PCI SSC treats loading as remote whenever the loading device and POI device are not co-located and directly connected.

P2PE and PIN pad key injection

PIN pad key injection for PIN acceptance is assessed under Annex B, as described above. Many KIFs also load data-encryption keys for point-to-point encryption (P2PE), and P2PE key injection is assessed as a P2PE component: the KIF component validation, which only a PCI SSC-listed P2PE Assessor can perform. Sovereign Secure is listed as a P2PE Assessor for Europe and the USA, so we can assess the PIN side under Annex B and the P2PE KIF component in one planned programme of fieldwork, with a separate report for each standard. See our P2PE assessments for how component validation and listing work, and our guide to what P2PE is for the background.

How our KIF assessment works

1. Scope. We confirm which parts apply (core, Annex A, Annex B), the key types, device models and POI versions, and the brands and acquirers you serve.
2. Documentation review. Key-flow diagrams, procedures, custodian records, key inventory and device approvals, reviewed before fieldwork.
3. Readiness review (optional). For new facilities, a gap review against Annex B with a prioritised fix list.
4. Fieldwork. We inspect the secure room and device storage, observe a live injection and key ceremony, sample access, CCTV and injection logs, reconcile inventory and interview custodians.
5. Reporting. A PIN Report on Compliance and Attestation of Compliance (AOC), with remediation verified before sign-off. If you wish, we submit your AOC to the PCI SSC PIN Service Provider list.

Physical controls are normally verified on site. PCI SSC allows remote assessment in defined circumstances; we agree the approach with you before fieldwork.

How much does a KIF assessment cost?

We quote a fixed price after scoping, because the effort depends on how your facility injects keys and how many sites it runs. The main cost drivers:

KIF readiness checklist

Before booking, check that you have:

• current architecture and key-flow documentation for every KIF platform;
• a device inventory reconciled from receipt to dispatch, with tamper-evident bag and serial numbers;
• un-keyed devices stored behind walls or cages reaching the real ceiling, with logged access;
• KLDs approved as secure cryptographic devices and locked under dual control when idle;
• named key custodians with signed agreements, none able to access more than one component of a key;
• logs recording date, time, purpose, names and signatures.

Use the enquiry form on this page to request the full checklist with the evidence we sample. If your business also needs PCI DSS validation, our free PCI compliance check gives a first view of that side.

Why Sovereign Secure for key injection facility audits

• Listed assessor. A PCI SSC-approved QPA, QSA and CPSA company, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. Check the Qualified PIN Assessor list.
• The whole payments chain. We also assess card production and provisioning and PCI DSS, and test POS and PIN devices through hardware penetration testing.
• International and certified. Head office in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka, and ISO 27001 certified. Clients include Fiserv, Cashplus and Ahli United Bank.

For background on the wider standard, read our guide to the PCI PIN Security Requirements.

Book a KIF assessment

Send your facility locations, injection methods (direct, RKI or both), device models and the acquirers asking for validation, and we will reply with a fixed scope and price. Contact us, call +44 161 523 5276, or call our Los Angeles office on +1 310 892 9654.