According to PCI SSC, you can hold onto a CVV and other sensitive authentication data until authorization has occurred. In other words, the restriction on storing sensitive authentication data applies to post authentication/processing storage.

Are the machines that the CVV is stored on until authorization in scope?

  • 3
    Why wouldn't they be? Jul 25, 2016 at 19:26
  • 1
    I believe they are but I'm receiveing push back because I'm unable to get a black and white response from the PCI DSS SSC.
    – Kuro
    Jul 26, 2016 at 11:01

1 Answer 1


Yes, the machines store, process, or transmit cardholder information (CHD) and/or sensitive authentication data (SAD), therefore they are in scope.

PCI DSS page 7 PCI DSS page 10

  • Is there any official documentation out there from PCS DSS SSC that states that?
    – Kuro
    Jul 26, 2016 at 10:59
  • Yes, I just updated my answer to include a screenshot from page 7 and page 10 of PCI DSS 3.2. Jul 26, 2016 at 11:48
  • Thank you John. You confirmed what I suspected. In relation to Tokenization I'm wondering How it will be viewed for Pre-Authorization? Would the machines be in scope because of the pre-authorization process? After authorization the information is deleted.
    – Kuro
    Jul 27, 2016 at 13:20
  • If the machines have access to the value before tokenization, it doesn't matter, they're still in scope. The part with prior to authorization is only about storage. Jul 27, 2016 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .