Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 68, Financial services, Subcommittee SC 2, Financial services, security.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

Fintech-centric financial innovation is indeed happening worldwide, and the proliferation of third-party payment (TPP) service providers (TPPSPs) is a significant aspect of this trend. TPPSPs offer innovative and convenient payment solutions, transforming traditional payment methods and reshaping the financial landscape. Furthermore, through TPP service, the TPP has facilitated the provision of various financial services across borders between member countries and thus reduced barriers to entry.

Since most of the information used by TPPSP includes the customer's personally identifiable information (PII), the security issue of the TPPSP becomes even more important. In addition, small and medium-sized TPPSPs can face greater risks due to their limited capacity for system implementation. Thus, payment service providers that provide TPP services with customer information have a responsibility to review the security measures and practices of the TPPSPs.

In accordance with the characteristic requirements, each TPPSP should establish and operate specific security controls on its own.

While ISO 23195 covers security objectives for TPPSP systems, this document covers organization-wide security controls for TPPSP which operate the systems based on the relevant control measures. The control measures include policies, human resources, the physical environment, application development, system operation, audit and continual improvement. The security controls for TPPSP covered in this document help to achieve the security objectives in ISO 23195 .

On the other hand, ISO/IEC 27002 is designed for organizations of all types and sizes as a reference for determining and implementing controls for an information security management system based on ISO/IEC 27001 . This document covers consolidated controls that are specific for TPPSP and that reflect the business characteristics of financial service, including privacy issues.

This document introduces security controls for TPPSP. The controls for TPPSP are categorized into governance security controls, cross-functional controls and function-specific controls.

Firstly, governance controls deal with overarching policies that guide an organization's approach to security. Specific elements of these controls are service security policies, roles and responsibilities, risk management, documentation, monitoring, review and improvement.

Secondly, this document introduces cross-functional controls that are necessary throughout the organization. This includes asset management, access management, supplier security, data security and TPP service continuity.

Lastly, function-specific controls that are tailored to specific areas of an organization's operations are explained. This includes vulnerability management, human security, physical security and system security such as server, network and application security.

Additionally, Annex A provides a mapping table which shows how the controls outlined in this document align with the security objectives provided in ISO 23195 .

1 Scope

This document gives requirements and guidance on security controls and implementation for third-party payment service providers (TPPSPs). This document deals with the overall security controls of TPPSPs from developing and testing to installing, operating and auditing the system. These security controls consist of:

security governance controls;
cross-functional controls;
function-specific controls.

2 Normative references

3 Terms and definitions

4 Abbreviated terms

5 Security governance controls

5.1 Service security policies

5.2 Roles and responsibilities

5.3 Risk management

5.4 Documentation

5.5 Monitoring, review and improvement

6 Cross-functional controls

6.1 Asset management

6.2 Access management

6.3 Supplier security

6.4 Data security

6.5 TPP service continuity

7 Function specific controls

7.1 Vulnerability management

7.2 Human security

7.3 Physical security

7.4 Server security

7.5 Network security

7.6 TPP application security

Bibliography