Card Production Security Assessor (CPSA)
PCI Card Production & Provisioning Security Assessments
A PCI card production audit validates a card vendor against the PCI Card Production and Provisioning Logical Security Requirements and Physical Security Requirements, which the card brands require before you handle their cards. As an approved Card Production Security Assessor (CPSA), we audit manufacturers, personalisers and provisioning providers, and help new facilities get ready.
Prefer to talk? Call +44 161 523 5276
- PCI SSC-approved CPSA
- Logical & physical security
- Consultancy for new facilities
Trusted by banks, payment providers and global brands
On this page
- Logical and physical security: what we assess and advise on
- Card Production and Provisioning: logical vs physical security requirements
- Card production vs PCI PIN vs PCI DSS: which do you need?
- Our four-phase card production assessment methodology
- Why choose Sovereign Secure for your card production audit?
- What our clients say
- Frequently asked questions
Overview
Who needs a PCI Card Production and Provisioning assessment?
The short answer
A PCI card production audit is an assessment of a card vendor, by a PCI SSC-approved Card Production Security Assessor (CPSA), against the PCI Card Production and Provisioning Logical and Physical Security Requirements. Card manufacturers, personalisers, PIN mailer services and mobile provisioning providers need one before the participating card brands let them handle their cards.
We are a PCI CPSA (Card Production Security Assessor), approved by the PCI Security Standards Council to validate card vendors against two standards: the PCI Card Production and Provisioning Logical Security Requirements and the PCI Card Production and Provisioning Physical Security Requirements, both published in the PCI SSC document library. You can find us on the PCI SSC list of Card Production Security Assessors, and we are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
Card vendors that manufacture, personalise or distribute payment cards, or provision card credentials into mobile devices, must be validated against the PCI Card Production and Provisioning Security Requirements before the card brands will allow them to handle their products.
In practice that means card manufacturers and chip embedders, personalisation bureaux, data preparation services, PIN generation and PIN mailer services, card distribution and fulfilment centres, and providers of cloud-based, secure element and other mobile credential provisioning. If you are opening a new site or adding one of these services, talk to the participating card brands early: they decide when an assessment is needed.
Our expertise covers every part of card production: manufacturing, chip embedding, personalisation, PIN generation and mailers, card distribution, EMV data preparation, key management, and mobile and cloud-based provisioning.
Beyond the audit itself, we help vendors build and expand facilities the right way first time: reviewing construction plans, access control, intrusion detection and CCTV designs, network architecture and the full information security policy suite. A new-facility readiness review gives you a gap report against both standards before your formal audit.
What happens during an on-site audit. We typically walk the site from the perimeter to the vault, observe production from blank stock to dispatch, and sample card reconciliation records, destruction logs, access logs and CCTV retention. On the logical side we review network and system configurations, user access, data preparation and personalisation environments, and key management procedures, including how keys and key components are held and used.
What affects the cost of a card production audit. The price depends on the number of sites and high-security areas, which services are in scope (manufacturing, personalisation, PIN mailers, provisioning), whether both the logical and physical requirements apply, whether you want a readiness review first, and travel for on-site work. We quote a fixed price after scoping.
What's included
Logical and physical security: what we assess and advise on
- 01
Physical security audits
Against the Card Production and Provisioning: Physical Security Requirements: site perimeter, high-security areas, vaults, access control, intrusion detection, CCTV coverage and guard responsibilities.
- 02
Logical security audits
Against the Card Production and Provisioning: Logical Security Requirements: network segmentation, system hardening, user access, logging and monitoring, and cryptographic key management for data preparation and personalisation.
- 03
Personnel and HR security
Pre-employment and ongoing screening, training, and separation of duties for staff in high-security areas.
- 04
Production process and audit trail
Material control, card counts and reconciliation, destruction of waste and rejected cards, and the full audit trail from blank stock to dispatch.
- 05
Visitor and third-party handling
Visitor processes, escorting, contractor access and shipping and receiving controls.
- 06
Business continuity
Business continuity and disaster recovery planning that keeps production secure when things go wrong.
- 07
Mobile and cloud provisioning
Assessments of providers that provision payment credentials into mobile devices and secure elements, including cloud-based provisioning, under the logical security requirements.
- 08
Facility build-out consultancy
Practical help when opening a new site, adding a service line or changing processes, before the formal audit, including a readiness review and gap report.
- 09
ISMS policy suite
Security policies and procedures written to satisfy both the PCI Card Production requirements and ISO 27001 where you need both.
Card Production and Provisioning: logical vs physical security requirements
The PCI SSC publishes two separate standards for card vendors. The Physical Security Requirements protect the premises, people and materials used to make, personalise, store and ship cards. The Logical Security Requirements protect the data, systems, networks and keys used for data preparation, personalisation, PIN generation and provisioning. Most vendors are assessed against both, and we test each one in its own right. How often you are assessed against either standard is set by the participating card brands, not by the PCI SSC.
| Requirement set | What it covers | Typical evidence |
|---|---|---|
| Physical: premises | Site perimeter and building construction, high-security areas and vaults | Site and high-security area plans, construction details and alarm zones |
| Physical: access and monitoring | Access control, visitor and contractor handling, intrusion detection, CCTV and guard duties | Access control and visitor logs, CCTV coverage and retention records, alarm and guard records |
| Physical: personnel | Pre-employment and ongoing screening, training and separation of duties for staff in high-security areas | Personnel screening files, training records and role assignments |
| Physical: materials and shipping | Material control, card counts and reconciliation, destruction of waste and rejected cards, shipping, receiving and packaging | Card reconciliation records, destruction logs, and shipping and receiving records |
| Logical: policy and data | Security policy, roles and responsibilities, and protection of issuer and cardholder data | Information security policies and procedures, and data handling procedures |
| Logical: networks and systems | Network security and segmentation, system hardening and vulnerability management, user management and access control, logging and monitoring | Network diagrams, configuration standards, vulnerability scan results, user access lists and log review records |
| Logical: cryptographic keys | Key management for data preparation and personalisation, PIN generation and electronic PIN distribution | Key management procedures, key inventories and key ceremony records |
| Logical: mobile and cloud provisioning | Cloud-based and secure element provisioning of payment credentials into mobile devices | Provisioning environment architecture, key management and access records |
We send a tailored evidence list during scoping, so you know which of these records to have ready for your PCI card production audit.
Card production vs PCI PIN vs PCI DSS: which do you need?
PCI DSS protects cardholder data in any business that takes or processes payments. The Card Production and Provisioning standards go much further on physical security, material control and cryptographic key management, because a card vendor holds blank stock, personalisation data and keys for many issuers. PCI PIN covers PINs and the keys that protect them. Many card vendors need more than one:
| Standard | What it protects | Who usually needs it | Who assesses |
|---|---|---|---|
| PCI Card Production and Provisioning (Logical and Physical) | Card stock, personalisation data, issuer keys, and the sites, systems and people that make, personalise and ship cards or provision credentials | Card manufacturers, personalisers, PIN mailer services, card distribution centres, and mobile and cloud provisioning providers | A Card Production Security Assessor (CPSA), on a cycle set by the participating card brands |
| PCI PIN Security Requirements | PINs and the cryptographic keys that protect them, from the PIN entry device to the host | Acquirers and their agents, processors and key injection facilities, plus card vendors that generate PINs or manage PIN keys when a brand asks | A Qualified PIN Assessor (QPA) |
| PCI DSS | Cardholder data and the systems, networks and people around it | Every merchant and service provider that stores, processes or transmits cardholder data, or can affect its security | A QSA for a Report on Compliance, or the business itself through a Self-Assessment Questionnaire |
A vendor that generates PINs or manages PIN keys may be asked for a PCI PIN assessment against the PCI PIN Security Requirements, and one that stores or processes cardholder data may also need PCI DSS audits. We are approved by the PCI SSC as a CPSA, QPA and QSA, so one team can plan all three together. To scope your audit, use the enquiry form and tell us your sites, services and the card brands you work with.
How it works
Our four-phase card production assessment methodology
- 1
Scoping and readiness
We confirm the sites, services (manufacturing, personalisation, PIN, provisioning) and card brands in scope. An optional pre-assessment visit and gap report lets you fix issues before the formal audit.
- 2
On-site audit
Physical and logical security assessment against the PCI Card Production requirements, with sampling of records, materials and system settings.
- 3
Reporting
Detailed report of compliance for submission to the participating card brands.
- 4
Remediation follow-up
We verify corrective actions and update the report where findings are closed.
Why Sovereign Secure
Why choose Sovereign Secure for your card production audit?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- Approved CPSA. Approved by the PCI Security Standards Council to perform card production assessments. Check the PCI SSC CPSA list.
- Help before the audit, not just at it. Our readiness consultancy covers construction plans, access control, intrusion detection and CCTV designs, with advisory and assessment work kept separate.
- One team for PCI DSS, PIN and CP. Card vendors often need all three; we assess them together to cut duplicate effort.
- GEAR member 2026 to 2028. Sovereign Secure sits on the PCI SSC Global Executive Assessor Roundtable, the forum where senior leaders of qualified assessor companies give the Council recommendations and input.
- Remote when needed. We have audited a card production facility remotely when circumstances required it, as our client feedback describes.
Testimonials
What our clients say
Sovereign Secure provided Payment Card Industry Compliance Services to Bamcard for the following standards: PCI CPSA, PCI DSS and PCI PIN. Even with the global COVID-19 pandemic, they managed to provide the best possible, knowledgeable support during the process of auditing and achieving compliance. The Sovereign Secure assessors were so helpful in these challenging times … with years of Payment Card Industry experience. We would happily recommend them to any company in need of the services mentioned.
The specialist team at Sovereign Secure provided valuable support throughout our EMV certification process. They demonstrated a keen understanding of PCI production requirements and expertly steered the audit to a successful conclusion. We commend them on their innovativeness in conducting the audit of our facility remotely and the proactive nature of their services. We want to make special mention of the Security Assessor, Agnes Ng for her professionalism, efficiency and undisputed industry knowledge. Agnes and her team at Sovereign Secure were a pleasure to work with and an excellent choice for anyone looking for security consultancy and assessment in the PCI Card Production Industry.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
Who needs a PCI Card Production assessment?
Any vendor that manufactures, personalises, embeds chips in, or stores and distributes payment cards for the participating card brands, and vendors that provision payment credentials to mobile devices. The brands set how often you must be assessed.
What is the difference between the logical and physical security requirements?
The physical requirements cover buildings, high-security areas, access control, CCTV, vaults and material handling. The logical requirements cover networks, systems, data preparation, personalisation data and cryptographic key management. Most vendors are assessed against both.
What is a CPSA?
A Card Production Security Assessor is a company, with individual assessors, qualified by the PCI SSC to validate card vendors against the Card Production and Provisioning Logical and/or Physical Security Requirements. Sovereign Secure is a CPSA company; you can check the PCI SSC CPSA list.
How much does a PCI card production audit cost?
It depends on the number of sites and high-security areas, the services in scope, whether both logical and physical requirements apply, whether you want a readiness review first and travel for on-site work. We give you a fixed quote after a scoping call.
Do mobile and cloud provisioning providers need a card production assessment?
If you provision payment credentials for the participating brands, usually yes. The Card Production and Provisioning standards cover cloud-based and secure element provisioning as well as physical card production, mainly through the logical security requirements.
What should we prepare for a card production audit?
Have your security policies and procedures, site and high-security area plans, access control and visitor logs, CCTV and alarm records, card reconciliation and destruction records, personnel screening files, network diagrams and key management procedures ready. We send a tailored evidence list during scoping, and an optional readiness review shows where the gaps are.
What happens if the audit finds non-compliance?
Findings are recorded in the report with the corrective action needed. Once you have fixed them, we verify the corrective actions and update the report where findings are closed. The participating card brands decide how open findings affect your approval.
Can you help us before the audit?
Yes. Many clients ask us to review construction plans, security system designs and policies before a new facility opens. Where we provide consultancy, we are careful to keep advisory and assessment work appropriately separated.
Can card production audits be carried out remotely?
Some evidence review and interviews can be remote, and we have audited a card production facility remotely when circumstances required it. Physical security requirements usually need on-site verification; we agree the approach with you and the relevant brands.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- PCI PIN security auditsPCI PIN security assessments and audits by a PCI SSC Qualified PIN Assessor for acquirers, processors, key injection facilities, ATM and POS networks.
- PCI DSS assessmentsPCI compliance audits and PCI assessments by a PCI SSC-approved QSA company: Report on Compliance, AOC and QSA-validated SAQs. Get a fixed quote.
- Key injection facility auditsKey injection facility (KIF) assessments by a PCI SSC Qualified PIN Assessor: PCI PIN Annex B, remote key injection and secure rooms. Get a fixed quote.
- ISO 27001 consultancyISO 27001 consultants from a UK firm that is ISO 27001 certified itself: gap analysis, ISMS build, internal audit and certification via MQA International.
- IoT & hardware testingIoT penetration testing and hardware security testing for connected devices and POS terminals: firmware, debug interfaces, radio and cloud APIs. Get a quote.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“…an excellent choice for anyone looking for security consultancy and assessment in the PCI Card Production Industry.”
Call +44 161 523 5276
Email [email protected]