Requirement 3: Protect stored cardholder data Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Not Yes CCW No N/A Tested 3.1 Are data-retention and disposal policies, procedures, and processes implemented as follows: Is data storage amount and retention time limited to Review data retention and that required for legal, regulatory, and/or business disposal policies and requirements? procedures Interview personnel Are there defined processes in place for securely Review policies and procedures deleting cardholder data when no longer needed for Interview personnel legal, regulatory, and/or business reasons? Examine deletion mechanism Are there specific retention requirements for Review policies and procedures cardholder data? Interview personnel For example, cardholder data needs to be held for X Examine retention requirements period for Y business reasons. Is there a quarterly process for identifying and Review policies and procedures securely deleting stored cardholder data that Interview personnel exceeds defined retention requirements? Observe deletion processes Does all stored cardholder data meet the Examine files and system requirements defined in the data-retention policy? records This testing procedure applies only to Issuers. 3.2 This testing procedure applies only to Issuers. Is sensitive authentication data deleted or rendered Review policies and procedures unrecoverable upon completion of the authorization Examine system configurations process? Examine deletion processes
Requirement 3: Protect stored cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 3.1 Are data-retention and disposal policies, procedures, and processes implemented as follows: Is data storage amount and retention time limited to that required for legal, regulatory, and/or business requirements? Review data retention and disposal policies and procedures Interview personnel Are there defined processes in place for securely deleting cardholder data when no longer needed for legal, regulatory, and/or business reasons? Review policies and procedures Interview personnel Examine deletion mechanism Are there specific retention requirements for cardholder data? For example, cardholder data needs to be held for X period for Y business reasons. Review policies and procedures Interview personnel Examine retention requirements Is there a quarterly process for identifying and securely deleting stored cardholder data that exceeds defined retention requirements? Review policies and procedures Interview personnel Observe deletion processes Does all stored cardholder data meet the requirements defined in the data-retention policy? Examine files and system records 3.2 This testing procedure applies only to Issuers. This testing procedure applies only to Issuers. Is sensitive authentication data deleted or rendered unrecoverable upon completion of the authorization process? Review policies and procedures Examine system configurations Examine deletion processes
PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.docx