Mobile retail authority navigator · Source review November 1, 2026
Before a checkout device is mounted to a counter, write down who can activate it, update it, replace it and support it after hours. The mounting drawing cannot answer those account questions. A mobile store also changes sites, so the same record must identify the primary connection, the fallback procedure and the person who decides whether sales can continue when connectivity fails.
Use the responsibility map below before releasing the counter, outlet and cable locations. The merchant, payment provider, IT owner and final builder should each close the fields assigned to their scope.
This page is a buyer and builder intake tool. It is not a PCI DSS assessment, payment-provider approval, network design, cybersecurity plan or promise of connectivity at an operating site. The merchant should confirm its compliance and reporting path with the acquirer, payment brand or other organization that accepts its PCI validation.
The selected photograph shows a real MT-8 mobile showroom interior with an installed display, customer tables and work surfaces. It does not show a payment terminal, router, concealed wiring, merchant account or completed checkout system. Those items remain project-specific.
01Start with the transaction owner
The retail operator should name the legal business that holds the merchant relationship and receives processor notices. Record the acquirer or payment provider, the support account, the approved terminal models and the person authorized to request replacements or account changes.
Outsourcing processing does not remove the merchant's responsibility to understand the shared payment-data duties. PCI Security Standards Council guidance tells merchants to confirm provider compliance, maintain written responsibility terms and validate their own applicable PCI obligations with the organization managing the compliance program.
Do not let the trailer order become the first place these choices appear. The final builder needs the released hardware and interface information. The merchant and its payment parties control the account and payment-security decisions.
02Assign the responsibility map
Use one accountable owner for each row. A supporting company may perform the work, but the record should still identify who accepts the result and who can authorize a change.
| Decision | Accountable owner to name | Evidence before layout release | Physical interface for the builder |
|---|---|---|---|
| Merchant account and PCI validation path | Merchant plus the acquirer, payment brand or other compliance-accepting entity | Account owner, provider contact, required validation method and written shared-responsibility terms | None until approved devices and services are identified |
| Payment terminal selection | Merchant and payment provider | Exact model, provider approval, vendor instructions, quantity, dimensions, power and connection type | Mounting location, reach, charging, cable path, service access and travel state |
| Terminal management and updates | Merchant IT owner or named third-party manager | Terminal-management-system owner, update method, remote-access boundary, support contact and replacement procedure | Service access without exposing or damaging other installed work |
| Device inventory and inspection | Merchant operations owner | Asset ID, assigned location, inspection method, tamper or substitution response and closeout record | Secure operating position and protected storage or removal plan |
| Primary and backup connectivity | Merchant IT or connectivity owner | Carrier or network service, router and SIM ownership, data plan, site test method, fallback procedure and escalation contact | Router location, antennas if specified, power, ventilation, cable path and access |
| Staff tablets and phones | Merchant IT or device owner | Company-owned or BYOD policy, enrollment, approved apps, authentication, updates, wipe and reassignment process | Charging and secure storage sized around the released devices |
| Venue network | Venue contact and merchant IT owner | Written access terms, supported connection, segmentation or security requirements, test window and support contact | Only the documented connection point; venue Wi-Fi is not an assumed fallback |
| Counter, mount and wiring | Final builder and qualified trades within the signed scope | Released device drawings, loads, mounting instructions, cable and ventilation requirements | Installed and tested physical interface with closeout evidence |
| Day-of-operation support | Merchant operations owner | Opening check, failure decision, manual or offline procedure approved by the provider, replacement access and incident log | Accessible labels and service points that do not require destructive access |
The downloadable version adds fields for status, due date, controlling document and acceptance evidence.
03Separate device ownership from installation
The company that fastens a terminal mount may not own the terminal, merchant account, software or remote-management system. Record those roles separately.
PCI SSC states that payment terminals are part of the cardholder data environment and that the applicable controls depend on the device and configuration. Its terminal guidance also says the merchant should keep a device inventory, follow vendor configuration instructions and protect card-present devices from tampering and substitution. When a third party manages terminals, the merchant and that provider should identify which duties belong to each party.
For the build team, that means the phrase POS by owner is incomplete. The release package should still state the model, mounting method, dimensions, power, connection, cable access, heat or ventilation needs, staff reach and travel condition. If the model is undecided, keep the mount and final cable opening on hold.
04Give connectivity an operating case
Write the connectivity plan around real sites rather than a generic claim of nationwide coverage. List the expected primary service for each operating pattern, how the team tests it before opening and what approved fallback exists.
The responsibility map should answer:
- who owns the router, SIM and service account;
- who can change the data plan or replace a failed component;
- where the router and any approved antenna equipment will be installed;
- which devices may use that connection;
- how staff recognize and report a failure;
- which procedure the payment provider permits when the primary connection is unavailable.
Do not promise offline payment behavior from the trailer layout. The selected payment system, provider configuration and merchant policy control that decision. A venue connection can be tested and documented, but it should not silently replace the merchant's own plan.
05Treat tablets and phones as managed equipment
A tablet used for checkout or inventory is part of the operating system even when it can be carried out of the trailer. Name the device owner, enrollment method, approved applications, authentication, update process, charging location, replacement path and end-of-service wipe or reassignment procedure.
NIST SP 800-124 Rev. 2 covers both organization-provided and personally owned mobile-device programs. It recommends managing security through the device lifecycle, including deployment, use and disposal. CISA's mobile-device checklist calls for managed updates, trusted-device conditions and strong authentication. Those publications are security references, not a design approval for a specific mobile store.
If staff will use personal phones, the merchant's IT owner should decide what business access is allowed and how company data is separated. The builder should not infer a BYOD policy from the presence of USB outlets.
06Translate the map into builder inputs
The final builder needs a controlled release, not a list of brands discussed during sales calls. For each installed item, provide the current cut sheet or provider instructions and mark the operating position, service clearance and travel state.
Coordinate the checkout map with the mobile showroom AV and power brief when screens, media sources and network equipment share the electrical plan. Use the fixture and travel-restraint schedule for mounted devices, removable tablets, printers, cash drawers and accessories that change condition before transport.
MOBITRUCK prepares the contracted shell system at its manufacturing operation in Estonia. In the current U.S. path, Concession Nation assembles the rolling shell and performs the VIN and applicable vehicle-certification work assigned to its stage. Concession Nation or another qualified U.S. builder may complete the retail interior under a separate scope. The signed proposal, released drawings and device-provider records control the responsibility split for the actual project.
07Download the responsibility map
Download the mobile retail checkout and connectivity responsibility map (CSV)
Complete the map with the merchant, payment provider, IT owner and final builder. Attach the approved device list and controlling provider instructions rather than copying technical values into an email.
The mobile retail trailer planning guide covers the wider customer visit, merchandising, inventory and travel-state brief. This navigator stays limited to checkout accounts, devices, connectivity, management and support.
Request a mobile retail project review with the completed responsibility map, proposed device list, operating-site assumptions and available provider documents. The project team can review the physical shell and builder interfaces while the merchant and its payment and IT parties close their controlled decisions.
08Sources checked November 1, 2026
- PCI Security Standards Council: How does PCI DSS apply to payment terminals?: terminal scope, configuration, device-management and provider-documentation guidance.
- PCI Security Standards Council: How should payment terminals be considered during a PCI DSS assessment?: terminal inventory, vendor support, updates, tamper protection, terminal-management systems and merchant / third-party responsibility boundaries.
- PCI Security Standards Council: Outsourced payment processing and merchant responsibility: written agreements, provider monitoring, shared responsibility and validation with the compliance-accepting entity.
- PCI Data Security Standard: payment-account security scope and the roles of merchants, processors, acquirers, issuers and service providers.
- NIST SP 800-124 Rev. 2: organization-owned and personally owned mobile-device management across deployment, use and disposal.
- CISA Mobile Device Cybersecurity Checklist for Organizations: managed updates, trusted-device conditions, authentication and network-communication practices.
- MOBITRUCK mobile retail trailers: current mobile-store, showroom and customer-interface context.
- MOBITRUCK manufacturing: current Estonia shell-system and U.S. rolling-shell / final-completion responsibility sequence.
Buyer guide
Decision memo
Release tool