A vendor receives cardholder information and keys from a bank. The vendor then performs the following: * Uses its HSM to create keys * Creates…

The described activities—using an HSM to create keys, formatting cardholder-specific data like PAN and name, and writing the formatted data to an encrypted file for the personalization hardware—perfectly align with the official definition of "Data Preparation." According to the PCI Card Production and Provisioning Logical Security Standard, Data Preparation is the process of formatting cardholder data and other sensitive information into the specific format required by the personalization system, which may include key generation. This is the logical phase that precedes the physical personalization of a payment card.

A. Data creation: This term is too generic; the process described is a specific, structured phase of card issuance, not just general data creation.

C. Manufacture: This refers to the physical production of the blank card stock or the embedding of a chip, not the logical preparation of data.

D. Pre-personalization: This term is not officially defined in the PCI Card Production standards. The activities listed precisely match the official definition of Data Preparation.

1. PCI Security Standards Council. (2020). PCI Card Production and Provisioning Logical Security Standard Version 3.0. Page 11, Glossary. The standard defines Data Preparation as the "Process of formatting cardholder data and other sensitive information into the specific format required by the personalization system. This may include key generation and derivation."

2. PCI Security Standards Council. (2020). PCI Card Production and Provisioning Logical Security Standard Version 3.0. Page 12, Glossary. The standard defines Personalization as the "Process of electronically programming and/or physically printing cardholder data onto a card," which is the step that follows Data Preparation.