If we were to store the following information about a credit card, would we need to be PCI-DSS compliance or are we out of scope? Please assume for the purposes of this question that we only store this information and don't actually process any credit card payments at all.

  1. Card BIN (first 6 digits)
  2. Card last 4 digits
  3. Expiry date
  • As a simple rule, if card holder data at any point traverses your network, (via device, files, even scanned files) you are in scope, even if it's to show that you don't store any of the information. – Shane Andrie May 16 '16 at 16:22
  • Thanks. Assuming that it's not considered "card holder data" if I only get the truncated card number and expiry date then in my use case, no card holder data will touch the network, servers, etc at all. A third party in this case will send us the truncated card number and the expiry date which I'm planning on one-way-hashing and storing, but that is all. – Luke Cousins May 16 '16 at 16:32

IANAQSA! That data doesn't put you in scope, but you're probably in scope anyway, but dint of whatever relationship you're in that gets you access to that non-scoped data.

To quote PCI-DSS 3.2 (emphasis as per source):

The primary account number is the defining factor for cardholder data. If cardholder name, service code, and/or expiration date are stored, processed or transmitted with the PAN, or are otherwise present in the cardholder data environment (CDE), they must be protected in accordance with applicable PCI DSS requirements.

If you never have the full Primary Account Number, then you do not have cardholder data. That is not to say that you're not subject to the DSS, however. Even a merchant who outsources all handling of their card data to their service provider is subject to something like the SAQ A (Self Assessment Questionnaire).

What you're describing (first 6, last 4) is called Truncation and is described in section 3.4 of the DSS. So someone - your service provider? - is truncating card numbers and handing those to you in lieu of card numbers. If that's the case, your service provider should be authoritative for helping you figure out what your scope is under the DSS.

It comes down to this:

PCI DSS applies to all entities involved in payment card processing—including merchants, processors, acquirers, issuers, and service providers.

Do those truncated numbers put you in scope? No. If you're receiving truncated numbers, are you likely in a relationship that makes you subject to the PCI DSS as above? Very likely, yes.

  • Thank you, that was very helpful and better explained for me to understand than some of the other questions linked to. – Luke Cousins May 16 '16 at 14:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.