Summary

• Page properties (2 modified, 0 added, 0 removed)

Details

Page properties

Author

...	...	@@ -1,1 +1,1 @@
1		-xwiki:XWiki.superuwe
	1	+xwiki:XWiki.uwe

Content

...	...	@@ -1,3 +1,11 @@
	1	+= Q0) Does CQM only care about production? =
	2	+
	3	+Within CQM the following principles apply:
	4	+
	5	+1. All relevant life cycle steps of a CQM certifiable product or component, including development, qualification, and quality monitoring activities, and all production steps, must be conducted by CQM certified entities.
	6	+1. It must not be possible to bypass CQM Certification by subcontracting parts of the life-cycle, for example only production, to a CQM certified subcontractor.
	7	+1. Unless the Vendor of a product is purely a reseller (see Q7), the Vendor of the product must carry their own CQM label covering the activities they conduct with respect to the life-cycle of the product or component they are selling to Mastercard issuers or CQM certified customers.
	8	+
1	1	= Q1) My card is made of another material but newly produced PVC. How does CQM apply? =
2	2
3	3	CQM applies independently of the card material.
...	...	@@ -22,15 +22,44 @@
22	22	* A Vendor has control of the product (including Components) the Vendor supplies, and of the related development, qualification, and manufacturing processes.
23	23	* A subcontractor is an entity that produces a component primarily according to the instructions received from their customer.
24	24
	33	+==== Example 1 ====
	34	+
25	25	An example for a Vendor is Company A who designs an IC, an ICM containing the IC, and an IL that works with the IC, and sells the ICM together with the IL to card manufacturers so they can produce cards.
	36	+
	37	+==== Example 2 ====
	38	+
26	26	An example for a subcontractor is Company B who embeds wire into a sheet of plastic according to a drawing and material specification received from their customer, for example as a subcontractor to Company A.
27	27
28		-Within CQM the following principles apply:
	41	+==== Example 3 ====
29	29
30		-1. All relevant life cycle steps of a CQM certifiable product or component, including development, qualification, and quality monitoring activities, and all production steps, must be conducted by CQM certified entities.
31		-1. It must not be possible to bypass CQM Certification by subcontracting parts of the life-cycle, for example only production, to a CQM certified subcontractor.
32		-1. Unless the Vendor of a product is purely a reseller (see Q7), the Vendor of the product must carry their own CQM label covering the activities they conduct with respect to the life-cycle of the product or component they are selling to Mastercard issuers or CQM certified customers.
	43	+Card manufacturer M procures an iacICM with ISO/IEC 7816-2 contacts, a BSM with a fingerprint sensor, and an iacIL containing the antenna and to connect the iacICM and the BSM from component supplier S. S is CQM certified for iacICM, BSM, and iacIL. S has developed and qualified the iacICM, BSM, and iacIL. S produces iacICM, BSM, and iacIL themselves, or uses subcontractors.
33	33
	45	+M's CQM Audit only needs to address M's ability to produce IAC from these components, including verification that S is CQM certified for these components. M only receives a CQM label for IAC.
	46	+
	47	+S's CQM Audit must have included iacICM, BSM, iacIL; S must maintain CQM labels for iacICM, BSM, iacIL.
	48	+
	49	+S is a Component Vendor for iacICM, BSM, iacIL.
	50	+
	51	+==== Example 4 ====
	52	+
	53	+Card manufacturer M procures an iacICM with ISO/IEC 7816-2 contacts, a BSM with a fingerprint sensor, and an iacIL containing the antenna and to connect the iacICM and the BSM from component supplier S.
	54	+
	55	+In addition one of the below points is true:
	56	+
	57	+* S is not CQM certified for iacICM, BSM, or iacIL,
	58	+* M had significant involvement in specifying, developing, or qualifying the iacICM, BSM, or iacIL.
	59	+
	60	+M's CQM Audit must include IAC and each component where
	61	+
	62	+* S is not CQM certified for, or
	63	+* where M had significant involvement in specifying, developing, or qualifying the component,
	64	+
	65	+and M receives CQM labels for IAC and each of the components included in M's CQM Audit.
	66	+
	67	+S's CQM Audit must have include the components M is not audited for; S must maintain CQM labels for the components M is not audited for.
	68	+
	69	+S is a Subcontractor for the components M is not audited for.
	70	+
34	34	= Q4) Do Subcontractors have to have their own CQM Certificate? =
35	35
36	36	It depends on what the Subcontractor is providing.