Software-based PIN Entry on COTS (SPoC) Standard

What it is

PCI SSC's own scope statement: "This standard offers security requirements for secure mobile payment acceptance solutions that enable transactions with PIN entry on a merchant commercial off-the-shelf (COTS) device (e.g., smartphone or tablet)."

The current version is 1.1, last updated 2020-06-01, per PCI SSC's own document-library data — no later version was found.

PCI SSC has announced a formal sunset period for this standard from 1 May to 31 October 2026 — see the sunset note on this record.

Who owns it

The standard is owned and published by the PCI Security Standards Council (PCI SSC).

Who assesses it

PCI SSC uses the same laboratory-evaluation model as MPoC and CPoC: "PCI-Recognized SPoC Laboratories" evaluate solutions against the standard, rather than the QSA model used for PCI DSS.

Who asks for it

Voluntary. PCI SSC's own page states: "Compliance programs for all PCI SSC standards are managed by the payment brands. Questions about which entities need to validate compliance to any PCI SSC standard, or whether use of a PCI-listed product is required and for which entities, should be referred to the payment brands." PCI SSC itself imposes no mandate on any entity.

PCI SSC's own page states: "Compliance programs for all PCI SSC standards are managed by the payment brands. Questions about which entities need to validate compliance to any PCI SSC standard, or whether use of a PCI-listed product is required and for which entities, should be referred to the payment brands." PCI SSC itself names no universal requirement.