USB PIN Pad Driver Software Compliance?

[deansta]

I am an ISO and looking into a couple of USB PIN pads to connect to the PC to run through a third party POS software or the Hypercom's SmartPayments Client. I know you can use serial connections but not too many PC's have serial ports anymore. I can use a serial to USB converter but that requires a driver as well. I am looking at using the Hypercom P1320 and the Verifone PIN Pad 1000SE USB. The devices themselves are both PCI and PED compliant but is the driver software needed to drive these devices also compliant?

[deansta]

If they are compliant, can someone show me documentation or a list to prove they are?

[andrewj]

Software to drive the PED devices does not need to be (and almost certainly can't be) compliant to the PCI PED criteria. If you are asking about compliance to other PCI criteria (eg DSS, or PA DSS), then I would look on the PA DSS approval list, and ask the manufacturer.

[jbhall56]

Drivers are merely software to get data from one interface to another (a low level conduit). In your case from/to the USB port to/from the system and the application that acts upon the data.

And, while drivers are not currently required to be certified, I wouldn't put it past the PCI SSC to require drivers to be certified in the future. The reason I believe this is that attack threats seem to be moving to intercepting data at the device and/or driver levels. As a result, I am recommending to clients that they monitor their drivers to make sure that they are not modified without a reason.