Defined Approach Requirements
3.3.2 SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.
Customized Approach Objective
This requirement is not eligible for the customized approach.
Applicability Notes
Whether SAD is permitted to be stored prior to authorization is determined by the organizations that manage compliance programs (for example, payment brands and acquirers). Contact the organizations of interest for any additional criteria.
This requirement applies to all storage of SAD, even if no PAN is present in the environment.
Refer to Requirement 3.2.1 for an additional requirement that applies if SAD is stored prior to completion of authorization.
This requirement does not apply to issuers and companies that support issuing services where there is a legitimate issuing business justification to store SAD).
Refer to Requirement 3.3.3 for requirements specifically for issuers.
This requirement does not replace how PIN blocks are required to be managed, nor does it mean that a properly encrypted PIN block needs to be encrypted again.
This requirement is a best practice until 31 March
2025, after which it will be required and must be fully considered during a PCI DSS assessment.
Defined Approach Testing Procedures
3.3.2 Examine data stores, system configurations, and/or vendor documentation to verify that all SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.
Purpose of requirement and procedures
SAD can be used by malicious individuals to increase the probability of successfully generating counterfeit payment cards and creating fraudulent transactions.
Good practice
Entities should consider encrypting SAD with a different cryptographic key than is used to encrypt PAN. Note that this does not mean that PAN present in SAD (as part of track data) would need to be separately encrypted.
Definitions
The authorization process is completed as soon as the response to an authorization request response—that is, an approval or decline—is received.
Note: This sub-requirement requirement falls within the primary PCI DSS Requirement 3: Protect Stored Account Data and secondary requirement 3.3 Sensitive authentication data (SAD) is not stored after authorization..
What is the PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards formed in 2004 by Visa, MasterCard, Discover Financial Services, JCB International and American Express. Governed by the Payment Card Industry Security Standards Council (PCI SSC), the compliance scheme aims to secure credit and debit card transactions against data theft and fraud.
While the PCI SSC has no legal authority to compel compliance, it is a requirement for any business that processes credit or debit card transactions. PCI certification is also considered the best way to safeguard sensitive data and information, thereby helping businesses build long lasting and trusting relationships with their customers.
Source: https://www.imperva.com/learn/data-security/pci-dss-certification/
What is the PCI SSC
The PCI SSC mission is to enhance global payment account data security by developing standards and supporting services that drive education, awareness, and effective implementation by stakeholders. We achieve this with a strategic framework to guide our decision-making process and ensure that every initiative is aligned with our mission and supports the needs of the global payments industry.
The four pillars of our strategic framework include:
- Increase industry participation and knowledge in the PCI Standards development process and stakeholder support for standards implementation. This ensures that standards and resources reflect and address industry needs and challenges.
- Evolve security standards and validation programs to support a range of environments, technologies and methodologies for achieving security. This ensures standards and resources that support and enable safe commerce and the flexibility to use different approaches to meet those standards.
- Secure emerging payment channels via development of PCI Standards and resources to support broader payment acceptance. This enables safe commerce in new and emerging card and card-based payment channels such as mobile and internet-of-things.
- Increase standards alignment and consistency of PCI Standards to minimize redundancy and support effective implementation.
PCI DSS certification
PCI certification ensures the security of card data at your business through a set of requirements established by the PCI SSC. These include a number of commonly known best practices, such as:
- Installation of firewalls
- Encryption of data transmissions
- Use of anti-virus software
Source: https://www.imperva.com/learn/data-security/pci-dss-certification/
You can learn more about the PCI DSS at https://www.pcisecuritystandards.org/