POS Terminal Help: Password Controls

Please consider the following:

• Access to sensitive transaction data and parameters stored at either the POS device or the acquiring systems should be controlled and limited to authorised staff.
• POS equipment should, in general, have two passwords, a “system password” to control changes to the functionality and setup of the terminal, and a “supervisor password” to control access to certain POS functions.
• Functions protected by the “system password” should include the following:
  
  • Initial software application download.
  • Modification of terminal parameters from the keyboard.
  • Other system-related POS equipment functions (i.e. diagnostics, etc.)

• Functions protected by the “supervisor password” should include the following:
  
  • Void/return/transaction reversal.
  • Settlement. 
  • Parameter download initialisation.

• System passwords should be changed from default settings on installation. The supervisor password should be set on a merchant level.