We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on site. Currently we think about storing cardholder name, 4 last digits of CC number and its expiration date.
What are the minimum requirements that should be held to store this sensitive data?
Edit: PCI DSS says:
The primary account number is the defining factor in the applicability of PCI DSS requirements. PCI DSS requirements are applicable if a primary account number (PAN) is stored, processed, or transmitted. If PAN is not stored, processed or transmitted, PCI DSS requirements do not apply.
So cardholder name and expiration date can be stored without being compliant. But what about 4 last digits of PAN?