Requirements & evidence
PCI Contactless Payments on COTS (CPoC)
PCI SSC's standard for accepting contactless card payments on a commercial off-the-shelf mobile device without a separate secure card reader. In its formal sunset window now, with MPoC as the designated successor.
- Edition on record
- v1.0
- Issuing authority
- PCI Security Standards Council — CPoC (opens in a new tab)
- Edition published
- Not stated by the authority
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for payments, mobile point-of-sale, across global. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Contactless kernel security
- Device and OS integrity
- Backend monitoring
- Solution management
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Source access and licensing
Freely downloadable from PCI SSC; PCI SSC's terms permit identifiers and structure, not verbatim requirement text, without a separate license.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
PCI Contactless Payments on COTS (CPoC) is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Named and tracked only; requirements not modelled as a control catalog.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked September 6, 2026. Confirm the applicable edition with the authority before beginning an assessment.
Announced transition
PCI SSC announced the formal sunset period for CPoC from 2026-05-01 to 2026-10-31, the same window as SPoC. PCI MPoC v1.1 is the standard's designated successor.
Authority’s stated timing: 2026-10-31 (sunset window closes)
Read the authority’s announcement (opens in a new tab)- v1.0Current edition on recordPublication date not recorded
Editions that coexist
PCI MPoC v1.1 (designated successor)
New solutions and any CPoC solution being migrated ahead of the sunset
Coexistence scheduled to end October 31, 2026.
Read the applicability source (opens in a new tab)Recorded change history
· PCI Contactless Payments on COTS (CPoC): the coexistence window for PCI MPoC v1.1 (designated successor) (applying to New solutions and any CPoC solution being migrated ahead of the sunset) is scheduled to close.
· PCI Contactless Payments on COTS (CPoC): PCI SSC announced the formal sunset period for CPoC from 2026-05-01 to 2026-10-31, the same window as SPoC. PCI MPoC v1.1 is the standard's designated successor.
Check the basis
Sources you can follow.
Corroborated through independent sources; direct verification with the authority was unavailable. Source verification was recorded on September 6, 2026.
- PCI Security Standards Council — CPoC (opens in a new tab)
Issuing authority and framework publication.
Catalog provenance and record details
Framework record: pci-cpoc-1-0.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Contactless kernel security · Device and OS integrity · Backend monitoring · Solution management.
Record last updated: September 6, 2026.
Common questions
A closer look.
What is PCI Contactless Payments on COTS (CPoC)?
PCI SSC's standard for accepting contactless card payments on a commercial off-the-shelf mobile device without a separate secure card reader. In its formal sunset window now, with MPoC as the designated successor.
Who does PCI Contactless Payments on COTS (CPoC) apply to?
PCI Contactless Payments on COTS (CPoC) applies to payments, mobile point-of-sale, global, per PCI Security Standards Council — CPoC.
What is the current version of PCI Contactless Payments on COTS (CPoC)?
The current edition is v1.0, issued by PCI Security Standards Council — CPoC. Source: https://www.pcisecuritystandards.org/standards/contactless-payments-on-cots-cpoc/.
What does an assessment under PCI Contactless Payments on COTS (CPoC) require?
No control catalog has been ingested for PCI Contactless Payments on COTS (CPoC) yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
PCI Contactless Payments on COTS (CPoC)
v1.0
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Independent corroboration
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize PCI Contactless Payments on COTS (CPoC) requirements, evidence preparation, and review for your assessment scope.