ISO 7816 Part 4: Interindustry Commands for Interchange
ISO 7816 part 4, section..1 2 3 4 5 6 7 8 9 annex.. A B C D E F
What Part 4 is for
ISO/IEC 7816-4 is the logical heart of the smart-card standard. Parts 1 to 3 get a card powered up and moving bytes; Part 4 defines what those bytes mean. If you are writing terminal software, an applet, or a middleware layer, this is the part you will live in.
Its current edition is ISO/IEC 7816-4:2020, titled Organization, security and commands for interchange. Earlier editions carried the title Interindustry commands for interchange; the change reflects how much of the part is now about data organisation and security rather than commands alone.
The four things it defines
- A command/response structure. The APDU: a command carrying a class byte, an instruction byte, two parameters, optional input data and an optional expected response length; and a response carrying optional data followed by a two-byte status word.
- A way to organise data on the card. A hierarchical file system of dedicated files and elementary files, plus data objects addressed by tag.
- A security architecture. Access conditions attached to files and data, security status established by authentication, and secure messaging to protect commands in transit.
- A way to find and select an application. Application identifiers and the selection mechanisms that let one card host several unrelated applications.
How the pages in this section are organised
The pages linked above follow the structure of the topic rather than of any particular document. In rough order of usefulness to a developer starting out: the terminology and abbreviations pages establish vocabulary; the file structure and command pages cover the day-to-day work; the transport pages explain how APDUs ride on T=0 and T=1; and the encoding and secure messaging pages cover the parts that most often go wrong in integration.
A note on scope
Part 4 defines behaviour at the interface — what a terminal can observe. It deliberately does not prescribe how a card implements any of it internally, and it does not define the cryptographic algorithms themselves. Payment schemes such as EMV, identity schemes, and transit specifications all build on this base and add their own mandatory profiles; conforming to Part 4 is necessary for those, not sufficient.
Authoritative source
For the normative specification, refer to ISO/IEC 7816-4:2020, Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange, published by ISO, together with its Amendment 1:2023. The pages in this section are Ambimat’s own explanatory material and do not reproduce or replace the standard.