Storing credit card numbers for enterprise payments

Question

There is a business requirement to store credit card numbers on behalf of end users in the enterprise for the use cases below.

Currently these users store credit card numbers in insecure locations such as Microsoft Sticky Notes, Microsoft Outlook tasks, etc.

There are enterprise policies that disallow the storage of credit card numbers including holding printed copies.

To support the end users in the organization in the use cases below, what are the options to store the credit cards securely without compromising PCI-DSS compliance?

For example, are there services that are PCI-DSS compliant that enable the storage of credit cards? Additional features such as the ability to auto-complete a payment page would be a bonus.

An earlier post had suggested the use of online password managers however these services are not PCI-DSS compliant.

First use case

As a personal administrator of a collection of Executives, i am required to book venues, flights, accommodation and events. These services require me to use a credit card for payment. Since i am a personal administrator of several Executives, i am also the custodian of their credit cards. I currently use Microsoft Sticky Notes.

Second use case

As a business owner within the organization, i am issued with a company credit card. I use the credit card to make payments online for cloud services. I currently store the credit card number in a Microsoft Word document that is saved in OneDrive. This is to enable me to access the card details if i don't have access to the physical card.

Third use case

I am a senior manager. I organize payments for commercial services using a shared organizational credit card. The details of the credit card are stored in Microsoft Outlook tasks. This enables me to purchase services once approval has been confirmed. I am not issued with an individual credit card.

Answer 1

In my PCI work, I have not dealt with this question, but my understanding is that it depends on the issuer, brand and corporate context.

Visa and MC in the past have considered PCI at the enterprise level to apply to all PANs the enterprise has visibility into as part of its business, including issued corporate cards. Amex sometimes has not.

I would advise reaching out to your counsel and your issuer to understand what your issuing agreement says, and what their practice opinions are.

Independent of whether or not PCI applies, I would also advise reaching out to your security team to arrange a solution that allows for segregated storage of PANs outside of their reference in common corporate data systems like email, tasks, and calendar to satisfy the use cases that you have carefully, clearly, and helpfully outlined.

This may take the shape of a corporate-level secret management solution, which does not specifically apply to credit cards but which does support segregating the storage and transmission of sensitive information so that, for instance, emails/tasks/calendars can say "use card #25 for this" rather than "use PAN 5555... expiration xx/yy for this."

Answer 2

If you are talking about your own company-owned credit cards then this has nothing to do with PCI compliance at all. No one cares how you store your own organizations cards. Heck, you can keep pictures of them in a Facebook photo album for the whole world to see, and no one will ask you to stop or fine you (although your bank might deny liability and force you to pay the bill if you violate their terms of service).

PCI compliance is about storing other people's credit cards so you can bill them for services they are requesting from you. There are many services that provide PCI compliant credit card storage for such purposes (Stripe is just one example) but none of these services will work for you because all of them explicitly hide the credit card details (that is the point after all). In essence the exchange with the CC processor looks like this: you would like to bill Bob's credit card for something he would like to buy, the CC processor then speaks directly to Bob to get the credit card number, and then you tell the processor how much to bill. You never actually have the card yourself and the processor will never share the details with you.

This is obviously completely different than what you want. These are your own credit cards so there is no point in hiding the details from yourself - you just want to store them securely. This isn't the place for product recommendations but I think you have your answer anyway: things like password managers or the like are a perfectly reasonable choice because you don't have to worry about PCI compliance with your own credit cards. In fact, PCI compliance doesn't even make sense here.

Answer 3

The other comments are spot on. Technically this is what's referred to as "issuer risk" so you could check the contract you have with whoever issued the cards, or ask them. The important consideration is that if these card details were compromised and used fraudulently, it would technically be your liability for not taking appropriate security. So from an information security perspective, assess the risk and then take appropriate security (and ignore PCI DSS compliance). In many places I've consulted, a password manager was the right answer.

Also there's a really unhelpful FAQ on the PCI SSC website: https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/If-a-merchant-or-service-provider-has-internal-corporate-credit-cards-used-by-employees-for-company-purchases-like-travel-or-office-supplies-are-these-corporate-cards-considered-in-scope-for-PCI-DSS