3.1 Stored account data protection processes and roles
Requirement 3.1 asks for current policies and procedures for protecting stored account data and documented roles for data retention, encryption and key management activities.
Requirement 3 Protect stored account data
Requirement 3 covers protection of stored account data: retention limits, no stored sensitive authentication data, PAN masking and unreadability, and key management. Each page covers one second-level requirement.
3.2 Account data storage minimization
Requirement 3.2 keeps stored account data to a minimum through retention and disposal policies, defined retention periods with business justification, secure deletion, and a quarterly check that expired data is gone.
3.3 Sensitive authentication data after authorization
Requirement 3.3 forbids keeping sensitive authentication data (full track data, card verification codes, PINs and PIN blocks) after authorization, even encrypted, and sets extra rules for issuers and for SAD held before authorization.
3.4 PAN display and copy restrictions
Requirement 3.4 limits who can see full PAN on screens, receipts and reports (masking to at most the BIN and last four digits) and blocks copying or moving PAN through remote-access technologies without authorization.
3.5 Securing stored PAN
Requirement 3.5 requires stored PAN to be unreadable wherever it is kept, using keyed hashes, truncation, index tokens or strong encryption, and limits disk-level encryption to removable media unless PAN is also protected another way.
3.6 Securing cryptographic keys
Requirement 3.6 secures the cryptographic keys that protect stored account data: few custodians, key-encrypting keys at least as strong as data keys and stored separately, approved storage forms, and a documented cryptographic architecture for service providers.
3.7 Key management lifecycle
Requirement 3.7 defines the key management lifecycle for keys protecting stored account data: generation, distribution, storage, cryptoperiods, retirement and replacement, split knowledge and dual control, and custodian acknowledgment.
