I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few million SSNs attached to names, addresses, work history, pay history...etc

As I'm working through their codebase, I keep wondering if there are any regulations that they need to be compliant of. Right now SSNs are encrypted in the DB, but anyone can log into their public-facing web app as an admin with an insecure password (Something as simple as admin@company.com, pw: admin) and view them in plain text, and existing employees can search for SSNs and view information on the numbers holders.

Is there any sort of compliance (similar to PCI for payment info) that needs to be followed/adhered to for SSNs and personal information?

  • 1
    nvlpubs.nist.gov/nistpubs/Legacy/SP/… Classifies SSN as PII (duh), and then states that all PII should be protected by "reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data." – Artog Jul 15 at 12:10

Yes, PCI-DSS. However they are not a federal mandate like NERC-CIP

  • Wrong sir. PII which includes social security numbers, is most often encoded on the RFID or magnetic tape on credit cards. – jas- Feb 10 '18 at 10:43
  • 2
    PCI only concerns itself with payment processing data, which includes: Primary account number, Cardholder name, service code, card expiration date, CVV, PIN, and card track data. It doesn't concern itself with SSN or other PIIs that a company may have collected. – Lie Ryan Jul 15 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.