3.2.1Storage of account data is kept to a minimum

Storage of account data is kept to a minimum.

Defined Approach Requirements:

Account data storage is kept to a minimum through the implementation of data retention and disposal policies, procedures, and processes that include at least the following:

- Coverage for all locations of stored account data.

- Coverage for any sensitive authentication data (SAD) stored prior to completion of authorization. This bullet is a best practice until its effective date; refer to applicability notes below for details.

- Limiting data storage amount and retention time to that which is required for legal or regulatory, and/or business requirements.

- Specific retention requirements for stored account data that defines length of retention period and includes a documented business justification.

- Processes for secure deletion or rendering account data unrecoverable when no longer needed per the retention policy.

- A process for verifying, at least once every three months, that stored account data exceeding the defined retention period has been securely deleted or rendered unrecoverable.

Defined Approach Testing Procedures:

3.2.1.a Examine the data retention and disposal policies, procedures, and processes and interview personnel to verify processes are defined to include all elements specified in this requirement.

3.2.1.b Examine files and system records on system components where account data is stored to verify that the data storage amount and retention time does not exceed the requirements defined in the data retention policy.

3.2.1.c Observe the mechanisms used to render account data unrecoverable to verify data cannot be recovered.