I am trying to find out if a credit card application would be in-scope for PCI DSS. As part of the application process, customers can submit their credit card number (PAN) from another institution. No other data is captured from the credit card other than the customer's name of course.

Does this make it in-scope? I found this the below statement but it says AND. Thoughts?

CHD, at a minimum, is the cardholder’s name, the primary account number (PAN) and the expiration date. Any additional information from a credit card such as CVV/CVC/CID and track data is also considered CHD, but it may not be stored except during the authorization of a transaction.

  • 1
    I googled your title: pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf Check out the chart – schroeder May 6 at 21:45
  • When quoting something, make sure to cite the source. Let me guess, it's from a blog from 2009? When in doubt, please look up the authoritative sources for the regulations, not someone's interpretations. Authoritative sources tend not to use ambiguous language. – schroeder May 6 at 21:47

The PAN alone is sufficient to make it in-scope. To quote PCI DSS 3.2.1 "PCI DSS Applicability Information":

The primary account number is the defining factor for cardholder data. If cardholder name, service code, and/or expiration date are stored, processed or transmitted with the PAN, or are otherwise present in the cardholder data environment (CDE), they must be protected in accordance with applicable PCI DSS requirements.

So in your example, because the full PAN is being included, it and the cardholder name must be protected in accordance with the PCI DSS.

  • Thank you, much appreciated. – Blackout May 7 at 18:00

Your answer is clearly explained in the PCI-DSS guidelines. The PAN, even by itself, requires protection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.