Hi @VladislavLysov Welcome.
I am afraid you will need to a bit more specific; there seems to be a slight difference between storing and transmitting details. Some data should never be stored, even in the encrypted form, such as item 3.2.3, which says: "Do not store the personal identification number (PIN) or the encrypted PIN block."
Going back a step, Requirement 3: Protect stored cardholder data
3.1 - Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures and processes, as follows.
3.2 - Do not store snsitive authentication data after authorization (even if encrypted).
Sensitive data in this context are:
- Card Verification Value
- PIN or the encrypted PIN Block
The full contents of the Magnetic Stripe
Regarding the Magnetic Stripe, PCI itself says that in "the normal course of business, the following data elements from the magnetic stripe may need to be retained:
- Cardholder Name
- Primary Account Number (PAN)
- Expiration Date
- Service Code"
3.3 - Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed).
So to sum up and (hopefully) answer your questions, 1) In my view, the whole communication should be done in an encrypted manner 2) none of the items of the three bullet points should ever be stored, neither encrypted, nor masked. What you mentioned about masking concerns the storage of the PANs, which should not be visible to anyone else apart from the very few users who have the right to see it in order to carry on their jobs. In cases where the PAN is displayed, say, to the user, then that's when you need to mask it as not to show the whole number. CVVs, PINs should never be stored anywhere, including the logs you mentioned. You may store (for not longer than necessary) some of the magnetic stripe contents, and that should be encrypted. You may also store PANs, but again they need to be masked out in the general logs and when presenting it to users.