By January 1, 2024, an owner or operator is required to take
two or more of these measures to protect each device:
(1) replace each factory installed universal locking
mechanism with a locking device that utilizes a unique device-specific
or site-specific key code or combination;
(2) utilize tamper-evident security labels. Tamper-evident
security labels must:
(A) be placed over each panel opening that provides
access to an interior portion of the device from which the payment
terminal or the device can be accessed;
(B) have a unique serial number or unique custom label
or easily identifiable custom label or graphic; and
(C) be replaced if damaged, perforated, or peeled;
(3) install a physical barrier, lock, or other physical
securing device that restricts access to the electronic financial
transaction compartment of the device;
(4) install and maintain monitoring devices or sensors
on all doors or panels providing access to an interior portion of
the device and associated payment terminal components which emit an
audible alarm and/or disable the device when unauthorized access is
attempted;
(5) retrofit, upgrade, or replace each device with
an enabled EMV-compliant payment terminal that meets the security,
interoperability, and functionality specifications issued by EMVCo,
LLC; or
(6) install and maintain a high-resolution video camera
system and forecourt lighting. To meet the requirements of this section:
(A) the video camera system must record the forecourt
area at all times, and the system must retain all videos for 30 days
or more. Cameras must be positioned to record:
(i) each device;
(ii) the license plates of vehicles approaching or
departing the immediate area around each device; and
(iii) any person interacting with each device at a
pixel density of at least 50 pixels per foot; and
(B) lighting must be bright enough to ensure a minimum
illumination of 10 lumens per square foot at grade.
|
