CCSS™ is technology neutral and does not mandate the use of a Hardware Security Module (HSM) or any other specific technology. An entity’s system can achieve compliance across all three levels using alternative architectures. HSMs are treated as one valid implementation mechanism that can satisfy CCSS requirements.