I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few million SSNs attached to names, addresses, work history, pay history...etc

As I'm working through their codebase, I keep wondering if there are any regulations that they need to be compliant of. Right now SSNs are encrypted in the DB, but anyone can log into their public-facing web app as an admin with an insecure password (Something as simple as admin@company.com, pw: admin) and view them in plain text, and existing employees can search for SSNs and view information on the numbers holders.

Is there any sort of compliance (similar to PCI for payment info) that needs to be followed/adhered to for SSNs and personal information?


Yes, PCI-DSS. However they are not a federal mandate like NERC-CIP

  • Wrong sir. PII which includes social security numbers, is most often encoded on the RFID or magnetic tape on credit cards. – jas- Feb 10 '18 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.