According to PCI SSC, you can hold onto a CVV and other sensitive authentication data until authorization has occurred. In other words, the restriction on storing sensitive authentication data applies to post authentication/processing storage.

Are the machines that the CVV is stored on until authorization in scope?

  • 3
    Why wouldn't they be? – Bryan Field Jul 25 '16 at 19:26
  • 1
    I believe they are but I'm receiveing push back because I'm unable to get a black and white response from the PCI DSS SSC. – Kuro Jul 26 '16 at 11:01

Yes, the machines store, process, or transmit cardholder information (CHD) and/or sensitive authentication data (SAD), therefore they are in scope.

PCI DSS page 7 PCI DSS page 10

  • Is there any official documentation out there from PCS DSS SSC that states that? – Kuro Jul 26 '16 at 10:59
  • Yes, I just updated my answer to include a screenshot from page 7 and page 10 of PCI DSS 3.2. – John Downey Jul 26 '16 at 11:48
  • Thank you John. You confirmed what I suspected. In relation to Tokenization I'm wondering How it will be viewed for Pre-Authorization? Would the machines be in scope because of the pre-authorization process? After authorization the information is deleted. – Kuro Jul 27 '16 at 13:20
  • If the machines have access to the value before tokenization, it doesn't matter, they're still in scope. The part with prior to authorization is only about storage. – John Downey Jul 27 '16 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.