Skip to main content
Information Security

Return to Answer

corrected spelling and a few grammar errors
Source Link
Timee
Timee
  • 591
  • 2
  • 9

I would agree with what the others have said and add a little to it. Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorization has occurred. In other words the restriction on storing sensitive authentication data applies to post authentication/processing storage. Here is a document from the PCI SSC about data storage requirments. See the "Technical Guidelines for PCI Data Storage" table. Footnote 2 to the table states:

Sensitive authentication data must not be stored after authorization (even if encrypted).

My advicesadvice as a QSA, would be that the pre-auth storage time needs to be reasonable from a business stand point. I would also want it to be as short as technically possible. If your data flow is similar to others in your industry and they are processing payments without storing sensitive data without storing for more then a few seconds at most, then I would expect the same fromof you.

I would agree with what the others have said and add a little to it. Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorization has occurred. In other words the restriction on storing sensitive authentication data applies to post authentication/processing storage. Here is a document from the PCI SSC about data storage requirments. See the "Technical Guidelines for PCI Data Storage" table. Footnote 2 to the table states:

Sensitive authentication data must not be stored after authorization (even if encrypted).

My advices as a QSA, would be that the pre-auth storage time needs to be reasonable from a business stand point. I would also want it to be as short as technically possible. If your data flow is similar to others in your industry and they are processing payments without storing sensitive data without storing for more then a few seconds at most, then I would expect the same from you.

Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorization has occurred. In other words the restriction on storing sensitive authentication data applies to post authentication/processing storage. Here is a document from the PCI SSC about data storage requirments. See the "Technical Guidelines for PCI Data Storage" table. Footnote 2 to the table states:

Sensitive authentication data must not be stored after authorization (even if encrypted).

My advice as a QSA, would be that the pre-auth storage time needs to be reasonable from a business stand point. I would also want it to be as short as technically possible. If your data flow is similar to others in your industry and they are processing payments without storing sensitive data for more then a few seconds at most, then I would expect the same of you.

Source Link
Timee
Timee
  • 591
  • 2
  • 9

I would agree with what the others have said and add a little to it. Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorization has occurred. In other words the restriction on storing sensitive authentication data applies to post authentication/processing storage. Here is a document from the PCI SSC about data storage requirments. See the "Technical Guidelines for PCI Data Storage" table. Footnote 2 to the table states:

Sensitive authentication data must not be stored after authorization (even if encrypted).

My advices as a QSA, would be that the pre-auth storage time needs to be reasonable from a business stand point. I would also want it to be as short as technically possible. If your data flow is similar to others in your industry and they are processing payments without storing sensitive data without storing for more then a few seconds at most, then I would expect the same from you.