ISO/TS 9546:2024
(Main)Guidelines for security framework of information systems of third-party payment services
Guidelines for security framework of information systems of third-party payment services
This document provides guidelines for a security framework to address the implementation of security mechanisms in technical infrastructures designed for the provision of third-party payment (TPP) services in order to achieve the security objectives defined in ISO 23195. The security framework is intended to protect critical systems and objects within the TPP system environment, either under the direct control of the third-party payment service provider (TPPSP) or by another entity (e.g. a bank). This document is applicable to the provision of any TPP service, including: — the TPP logical structural model; — the definition of the security framework; — the design principles, responsibilities and functional recommendations to support the security mechanism; — guidelines for applying the security framework defined in this document.
Lignes directrices relatives au cadre de sécurité des systèmes d'information des prestataires de services de paiement
General Information
Standards Content (Sample)
Technical
Specification
ISO/TS 9546
First edition
Guidelines for security framework
2024-12
of information systems of third-
party payment services
Lignes directrices relatives au cadre de sécurité des systèmes
d'information des prestataires de services de paiement
Reference number
© ISO 2024
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 4
5 TPP logical structural models . 4
5.1 General introduction .4
5.2 TPP logical structural model without the TPP-AIS .4
5.3 TPP logical structural model with the TPP-AIS .5
6 TPP security functional recommendations . 6
6.1 General security functional recommendations.6
6.1.1 General .6
6.1.2 Identification and authentication .6
6.1.3 Authorization .7
6.1.4 Audit logging .8
6.1.5 Asset protection .8
6.2 Security functional recommendations for TPPSP credentials carrier (C2) .8
6.2.1 Encryption .8
6.2.2 User authentication .9
6.2.3 Access control .9
6.3 Security functional recommendations for payment terminal (C3) .9
6.3.1 Encryption .9
6.3.2 User authentication .9
6.3.3 Logical security .9
6.3.4 Transaction security .9
6.3.5 Payment-sensitive information protection .10
6.4 Security functional recommendations for TPPSP gatekeepers (C5) .10
6.4.1 Access control .10
6.4.2 Transaction security .10
6.4.3 Audit logging .10
6.5 Security functional recommendations for TPP-BIS (C6).10
6.5.1 User authentication .10
6.5.2 Transaction security .11
6.5.3 Payment-sensitive information protection .11
6.5.4 Risk control .11
6.6 Security functional recommendations for TPP-AIS (C15) .11
6.6.1 Encryption .11
6.6.2 Identity verification .11
6.6.3 Transaction security .11
7 TPP security framework.11
7.1 Security framework overview .11
7.2 Process layer. 12
7.2.1 Overview . 12
7.2.2 Identification and authentication . 12
7.2.3 Authorization . 13
7.2.4 Audit logging . 13
7.2.5 Asset protection . 13
7.3 Application layer .14
7.3.1 Overview .14
7.3.2 Security measures for TPPSP credentials carrier (C2) .14
7.3.3 Security measures for TPP payment terminal (C3) .14
iii
7.3.4 Security measures for TPPSP gatekeeper (C5) . 15
7.3.5 Security measures for TPP-BIS (C6) . 15
7.3.6 Security measures for TPP-AIS (C15) .16
7.4 Infrastructure layer .16
8 Guidelines for implementation of the security framework .16
8.1 Overview of and steps for the guidelines .16
8.2 Real-world practices of the security framework .17
8.2.1 Overview .17
8.2.2 Practices of payment application (C3) .17
8.2.3 Practices of TPPSP gatekeeper (C5) and TPP-BIS (C6) .18
8.2.4 Practices of TPP-AIS (C15) .19
Annex A (informative) Examples of TPP implementation .20
Bibliography .24
iv
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO document should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. A
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.