PCI DSS v4.0/Requirement 03: Protect Stored Account Data/39 of 250
3.3.3Sensitive authentication data (SAD) is not stored after authorization
Control family: Requirement 03: Protect Stored Account Data
Control description
Defined Approach Requirements:
Additional requirements for issuers and companies that support issuing services and store sensitive authentication data: any storage of sensitive authentication data is:
- Limited to that which is needed for a legitimate issuing business need and is secured.
- Encrypted using strong cryptography. This bullet is a best practice until its effective date; refer to Applicability Notes for details.
Defined Approach Testing Procedures:
3.3.3.a Additional testing procedure for issuers and companies that support issuing services and store sensitive authentication data: Examine documented policies and interview personnel to verify there is a documented business justification for the storage of sensitive authentication data.
3.3.3.b Additional testing procedure for issuers and companies that support issuing services and store sensitive authentication data: Examine data stores and system configurations to verify that the sensitive authentication data is stored securely.