Requirements & evidence

PCI Point-to-Point Encryption

PCI SSC's standard for validated point-to-point encryption solutions that can reduce a merchant's PCI DSS scope. Part of the payments family beyond bare PCI DSS.

Edition on record: v3.2
Issuing authority: PCI Security Standards Council — P2PE (opens in a new tab)
Edition published: Not stated by the authority
Source last checked: September 6, 2026

Understand the scope

What the framework covers.

The library records this framework for payments, across global. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.

Areas of requirement

Encryption device management
Application security
Decryption environment
P2PE solution management

The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.

Source access and licensing

Freely downloadable from PCI SSC; PCI SSC's terms permit identifiers and structure, not verbatim requirement text, without a separate license.

Prepare with context

The evidence behind
the requirements.

Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.

A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.

ControlFrame availability

Framework reference available

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

How availability is determined

PCI Point-to-Point Encryption is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.

Named and tracked only; requirements not modelled as a control catalog.

Follow the source

Editions and transitions.

These are the editions recorded in the library, checked September 6, 2026. Confirm the applicable edition with the authority before beginning an assessment.

Announced transition

PCI SSC closed v3.1 solution submissions 2026-03-31. A v4.0 revision is in development; no publication date has been announced.

Authority’s stated timing: v4.0 in development; unannounced

Read the authority’s announcement

v3.2Current edition on record · Replaces v3.1
Publication date not recorded
v3.1Superseded edition
Publication date not recorded

Check the basis

Sources you can follow.

Corroborated through independent sources; direct verification with the authority was unavailable. Source verification was recorded on September 6, 2026.

PCI Security Standards Council — P2PE (opens in a new tab)
Issuing authority and framework publication.
Edition reference: v3.2 (opens in a new tab)
The publication used to establish the recorded edition.

Catalog provenance and record details

Framework record: pci-p2pe-3-2.

Source artifact: acquisition required.

Parsed catalog: Not ingested.

Control families as published: Encryption device management · Application security · Decryption environment · P2PE solution management.

Record last updated: September 6, 2026.

Common questions

A closer look.

What is PCI Point-to-Point Encryption?

PCI SSC's standard for validated point-to-point encryption solutions that can reduce a merchant's PCI DSS scope. Part of the payments family beyond bare PCI DSS.

Who does PCI Point-to-Point Encryption apply to?

PCI Point-to-Point Encryption applies to payments, global, per PCI Security Standards Council — P2PE.

What is the current version of PCI Point-to-Point Encryption?

The current edition is v3.2, issued by PCI Security Standards Council — P2PE. Source: https://www.pcisecuritystandards.org/standards/point-to-point-encryption-p2pe/.

What does an assessment under PCI Point-to-Point Encryption require?

No control catalog has been ingested for PCI Point-to-Point Encryption yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.

At a glance