There is a business requirement to store credit card numbers on behalf of end users in the enterprise for the use cases below.
Currently these users store credit card numbers in insecure locations such as Microsoft Sticky Notes, Microsoft Outlook tasks, etc.
There are enterprise policies that disallow the storage of credit card numbers including holding printed copies.
To support the end users in the organization in the use cases below, what are the options to store the credit cards securely without compromising PCI-DSS compliance?
For example, are there services that are PCI-DSS compliant that enable the storage of credit cards? Additional features such as the ability to auto-complete a payment page would be a bonus.
An earlier post had suggested the use of online password managers however these services are not PCI-DSS compliant.
First use case
As a personal administrator of a collection of Executives, i am required to book venues, flights, accommodation and events. These services require me to use a credit card for payment. Since i am a personal administrator of several Executives, i am also the custodian of their credit cards. I currently use Microsoft Sticky Notes.
Second use case
As a business owner within the organization, i am issued with a company credit card. I use the credit card to make payments online for cloud services. I currently store the credit card number in a Microsoft Word document that is saved in OneDrive. This is to enable me to access the card details if i don't have access to the physical card.
Third use case
I am a senior manager. I organize payments for commercial services using a shared organizational credit card. The details of the credit card are stored in Microsoft Outlook tasks. This enables me to purchase services once approval has been confirmed. I am not issued with an individual credit card.