I read PCI DSS, and it's not very clear in which contexts you can have the PAN in cleartext. One could think in no context, but that is impossible. You need it in clear text of course to print it physically in the card. They say "only personal with legitimate business need can see the full PAN". They say "see", but they do not explain see on what or how. To print something, we generally need a file that contains what we are going to print. So in that context is allowed to store the pan in clear text? If no, how issuers print the card?
To print something, we generally need a file that contains what we are going to print. So in that context is allowed to store the pan in clear text? If no, how issuers print the card?
No, in that context the PAN would need to be stored reversibly encrypted as per DSS §3.4. The actual decryption for printing purposes is not "storage" and does not trigger the same requirements.
PAN gets passed around unencrypted in multiple steps of the credit card payment process. It's storage and transmission of PAN data that have requirements around encryption or obfuscation; the actual use of PAN data cannot be so limited for the obvious reasons.
@gowenfawr is correct, stored PAN would be encrypted, but decrypted in the card production process. But the standard that applies to card issuing and personalization is the PCI Card Production Standard which is way more stringent than PCI DSS:
- Card Production and Provisioning Logical Security Requirements
- Card Production and Provisioning Physical Security Requirements
See https://www.pcisecuritystandards.org/document_library and filter by "Card Production".