ITSO Specification
ISAM
ISMS
What is an ISAM
The ITSO Secure Application Module (ISAM) is a specialised, high-security cryptographic hardware module that underpins the security of the ITSO smart ticketing framework.
It is a mandatory component within every ITSO-compliant ticketing device and back-office system, ensuring that tickets, transactions and scheme data remain secure and trusted across the national network.
Physically, the ISAM is built using secure smartcard chip technology and is typically supplied in a flexible, SIM-style format, allowing it to be installed in a wide range of equipment types.
In simple terms, the ISAM securely stores the keys and rules that allow ITSO products to be created, validated and processed - without risk of tampering or fraud.
What does an ISAM do?
Prevents fraud and cloning
Secures transaction data
Enables interoperability
Protects the passenger
Where is the ISAM used?
Every bus ticket machine, rail gate or platform validator contains a unique ISAM. This ensures that every ITSO ticket validation, product update or transaction is cryptographically secured at the point it takes place.
In back-office systems, such as the Host Operator Processing Systems (HOPS), a specialised form of ISAM, commonly referred to as an HSAM, verifies incoming transactions, secures system-to-system messaging, and finalises settlement data, maintaining trust across independently operated schemes.
Who can purchase ISAMs
ISAMs are tightly controlled security devices and can only be purchased by organisations that hold a valid ITSO Operating Licence and are authorised to operate within the ITSO framework. This ensures that only approved and accountable parties are able to create, validate or process ITSO products.
Orders are placed through ITSO’s controlled supply process, with each ISAM issued against a registered organisation and specific authorised use. Allocation is governed by strict identity verification and security procedures.
This controlled distribution model protects the integrity of the national ITSO environment and ensures that only trusted systems can participate in secure ticketing operations.
