Protect Cardholder Data Requirement 3: Protect stored cardholder data Response one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A (c) Is sensitive authentication data deleted or rendered 3.2 Review policies and procedures unrecoverable upon completion of the authorization Examine system configurations process? Examine deletion processes (d) Do all systems adhere to the following requirements regarding non-storage of sensitive authentication data after authorization (even if encrypted): 3.2.2 The card verification code or value (three-digit or Examine data sources including: number printed on the front or back of a payment Incoming transaction data card) is not stored after authorization? All logs History files Trace files Database schema Database contents 3.2.3 The personal identification number (PIN) or the Examine data sources including: encrypted PIN block is not stored after authorization? Incoming transaction data All logs History files Trace files Database schema Database contents 3.3 Is the PAN masked when displayed (the first six and last Review policies and procedures four digits are the maximum number of digits to be Review roles that need access to displayed) such that only personnel with a legitimate displays of full PAN business need can see the full PAN? Examine system configurations Note: This requirement does not supersede stricter Observe displays of PAN requirements in place for displays of cardholder example, legal or payment card brand requirements for point-of-sale (POS) receipts.
Protect Cardholder Data Requirement 3: Protect stored cardholder data PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 3.2 (c) Is sensitive authentication data deleted or rendered unrecoverable upon completion of the authorization process? Review policies and procedures Examine system configurations Examine deletion processes (d) Do all systems adhere to the following requirements regarding non-storage of sensitive authentication data after authorization (even if encrypted): 3.2.2 The card verification code or value (three-digit or number printed on the front or back of a payment card) is not stored after authorization? Examine data sources including: Incoming transaction data All logs History files Trace files Database schema Database contents 3.2.3 The personal identification number (PIN) or the encrypted PIN block is not stored after authorization? Examine data sources including: Incoming transaction data All logs History files Trace files Database schema Database contents 3.3 Is the PAN masked when displayed (the first six and last four digits are the maximum number of digits to be displayed) such that only personnel with a legitimate business need can see the full PAN? Note: This requirement does not supersede stricter requirements in place for displays of cardholder example, legal or payment card brand requirements for point-of-sale (POS) receipts. Review policies and procedures Review roles that need access to displays of full PAN Examine system configurations Observe displays of PAN
SAQ_C-VT_v3.docx