Yes. However, while it may be possible for a PCI POI device to implement all the necessary functionality for use in a P2PE solution solely within its existing PTS-approved firmware, generally the POI device will contain additional software. Any software (whether it has access to cardholder data or not) that is present or intended to be present on the POI device within the P2PE solution that was not included in the PTS-approval of the POI's firmware must be assessed in accordance with the PCI P2PE standard. Note that it may be possible for additional (non-firmware) software to be present on the POI terminal during its PTS assessment. However, any software that does not meet the PTS definition of firmware is not reviewed as part of the PTS assessment or included in the PTS approval. The assessor must be diligent in identifying any non-firmware on the POI device(s). If the POI device contains ANY software that was not included in the POI device’s PTS-approved firmware, then that software MUST be assessed to the applicable PCI P2PE requirements. See also FAQ entitled What is the difference between POI firmware and additional software that may be present on the POI device?.
Article Number 1339