Section 2: Self-Assessment Questionnaire B Note: The following questions are numbered according to PCI DSS requirements and testing procedures, as defined in the PCI DSS Requirements and Security Assessment Procedures document. Self-assessment completion date: Protect Cardholder Data Requirement 3: Protect stored cardholder data Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes No N/A CCW (c) Is sensitive authentication data deleted or rendered 3.2 Review policies and procedures unrecoverable upon completion of the authorization Examine system configurations process? Examine deletion processes (d) Do all systems adhere to the following requirements regarding non-storage of sensitive authentication data after authorization (even if encrypted): 3.2.1 The full contents of any track (from the magnetic stripe Examine data sources including: located on the back of a card, equivalent data contained on Incoming transaction data a chip, or elsewhere) are not stored after authorization? All logs This data is alternatively called full track, track, track 1, track History 2, and magnetic-stripe data. Trace files Note: In the normal course of business, the following data Database schema elements from the magnetic stripe may need to be retained: Database contents The cardholder’s name, Primary account number (PAN), Expiration date, and Service code To minimize risk, store only these data elements as needed for business.
Section 2: Self-Assessment Questionnaire B Note: The following questions are numbered according to PCI DSS requirements and testing procedures, as defined in the PCI DSS Requirements and Security Assessment Procedures document. Self-assessment completion date: Protect Cardholder Data Requirement 3: Protect stored cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 3.2 (c) Is sensitive authentication data deleted or rendered unrecoverable upon completion of the authorization process? Review policies and procedures Examine system configurations Examine deletion processes (d) Do all systems adhere to the following requirements regarding non-storage of sensitive authentication data after authorization (even if encrypted): 3.2.1 The full contents of any track (from the magnetic stripe located on the back of a card, equivalent data contained on a chip, or elsewhere) are not stored after authorization? This data is alternatively called full track, track, track 1, track 2, and magnetic-stripe data. Note: In the normal course of business, the following data elements from the magnetic stripe may need to be retained: The cardholder’s name, Primary account number (PAN), Expiration date, and Service code To minimize risk, store only these data elements as needed for business. Examine data sources including: Incoming transaction data All logs History Trace files Database schema Database contents
cash-pic-saq-b-v3.docx