Certification Levels Explained

Card Production Security

Speak to a GRC expert

If you have any questions or need assistance, please don't hesitate to contact us.

Share on social media

Explore Our Services

We offer a comprehensive suite of cybersecurity and compliance services to help you protect your business and meet regulatory requirements.

Understanding PCI CPP Certification Modules

Each module isn’t just a checkbox—it defines the exact scope of your security obligations across card production stages.

Module A: Manufacturing

Covers chip and card fabrication—where security starts at the source.

Module B: Embedding

Secures chip insertion, personalization prep, and optical quality validation.

Module C: Personalization

Includes data encoding, printing, key injection, and identity linking.

Module D: Fulfillment

Focuses on secure packaging, warehousing, transport, and delivery traceability.

Full vs Partial Certification

Full Certification

Covers end-to-end production—from raw card input to final delivery.

Partial Certification

Applies to limited functions—like personalization or mailing only.

Scope Transparency

Clients and issuers must understand exactly what your certification includes.

Compliance Expectations

Even partial scope facilities must meet all applicable module requirements.

Certification by Service Scope

The services you offer dictate the standards you face—there’s no one-size-fits-all in secure card production.

Card Manufacturers Only

Require Module A—covers raw material fabrication, chip production, and security controls.

Embedding Providers Exclusively

Must certify for Module B, focused on chip placement and secure optical inspection.

Personalization Service Providers

Need Module C to validate encoding, printing, key injection, and final card configuration.

Fulfillment-Only Vendors

Are scoped under Module D for packaging, secure warehousing, and traceable distribution.

Multi-Service Facilities

Must combine all applicable modules—each service layer brings its own requirements.

Subcontracted Processors

Still fall under compliance—certification scope extends to outsourced components or functions.

Assessments That Matter

Annual assessments aren’t just dates on a calendar—they’re checkpoints of trust, continuity, and operational readiness.

Annual Certification Review

Every facility undergoes yearly audits by PCI-approved assessors with zero wiggle room.

Module-Specific Scoping

Only the services you offer are evaluated—nothing more, nothing less.

Physical Site Inspection

Assessors must visit facilities in-person to verify controls and infrastructure firsthand.

Logical Access Validation

Digital access rights, logging, and authentication protocols are tested under stress.

Key Management Controls

Cryptographic handling is reviewed for generation, storage, usage, and destruction procedures.

Personnel Role Checks

Staff vetting, training records, and dual-control procedures are verified against policy.

Continue Reading

Ready to learn more about Sample Facility Diagram?