2

The merchant in question has no electronic cardholder data storage.

Currently they receive CHD (no CVV) in non-secure ways and store it on paper in order to execute payments via card-not-present POS transactions.

What is a possible solution to securely receive these PANs and details, considering they will store them physically according to requirement 9 of the PCI DSS?

Thanks for your answers.

|improve this question
  • Requirement 3.4 - Render PAN unreadable anywhere it is stored... – R15 Dec 7 '17 at 6:38
  • What do you mean by "receive ChD in non-secure ways" - eg do you mean "customers send ChD by email and the company prints out the email before processing the transaction using PAN key entry on a traditional POS?" – withoutfire Dec 7 '17 at 7:15
  • That is what happens. Hence a solution to receive and store ChD is needed, without having onsite electronic storage. – Luvcarft Dec 7 '17 at 7:52
  • @r15 Doesn't that apply to electronic chd storage only? Requirement 9.5 guidance "Controls for physically securing media are intended to prevent unauthorized persons from gaining access to cardholder data on any type of media." - this implies that physical media can contain CHD (no CVV of course). – Luvcarft Dec 7 '17 at 12:48
  • @Luvcarft CHD is wider in scope than just PAN, the implication being PAN requirements can be in addition to CHD requirements. I'll add something more detailed as an answer when I get a chance. – R15 Dec 8 '17 at 11:52
1

The following a some best practices for storing paper with CHD in a compliant way. Note: this only addresses handling and storing the paper, not how the CHD is received in a "non-secure way."

  • Establish a record retention policy. The policy should state what is being stored, how it will be stored, how long it will be stored for, and the disposition of the paper at the end of the retention period. The policy should follow the DSS with regards to not storing CHD after authorization, cross cut shredding, etc.
  • Establish a record retention procedure. The procedure should outline the steps to follow to meet the requirements of the policy - particularly how the paper is to be handled and destroyed.
  • Establish a clean desk policy where papers with CHD cannot be left on the desk when a person is not at their desk.
  • Think through the entire lifetime of the paper with CHD - printing, movement, storage, sitting on desks, before authorization, after authorization, disposal, etc.
  • Operationally, here are some tips:
    • Have a locked cabinet with defined people with the key to the cabinet.
    • After authorization, black out the PAN with a thick magic marker. If the paper is no longer needed after authorization, shred it. If the paper is needed, store it in the locked cabinet. Sometimes people will even photocopy the paper after redaction (and shred the original) to fully get rid of PAN.
    • In the locked cabinet, have a tracking sheet to track when paper what put in and when it was removed and destroyed. I have seen it where one day's papers are in the same folder in the cabinet. That streamlines applying the record retention policy since all the employee needs to do is grab the aged-out folder and shred the contents.
    • If a third-party shredding company is used, you will need to assure that the shredding company is PCI compliant.
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.