0

I read PCI DSS, and it's not very clear in which contexts you can have the PAN in cleartext. One could think in no context, but that is impossible. You need it in clear text of course to print it physically in the card. They say "only personal with legitimate business need can see the full PAN". They say "see", but they do not explain see on what or how. To print something, we generally need a file that contains what we are going to print. So in that context is allowed to store the pan in clear text? If no, how issuers print the card?

Improve this question

2 Answers 2

Reset to default
2

To print something, we generally need a file that contains what we are going to print. So in that context is allowed to store the pan in clear text? If no, how issuers print the card?

No, in that context the PAN would need to be stored reversibly encrypted as per DSS §3.4. The actual decryption for printing purposes is not "storage" and does not trigger the same requirements.

PAN gets passed around unencrypted in multiple steps of the credit card payment process. It's storage and transmission of PAN data that have requirements around encryption or obfuscation; the actual use of PAN data cannot be so limited for the obvious reasons.

Improve this answer
2
  • Thanks for your reply. Why is it no storage if it is persisted on a disk? What draws the line between what PCI considers storage or not?
    – Sfp
    Sep 2, 2021 at 20:44
  • 1
    @Samuel in general if it's being processed for authorization, storage requirements may not apply. For example, writing out a batch file before submitting it. In general, the PCI auditor draws the lines around what's permissible.
    – gowenfawr
    Sep 2, 2021 at 21:23
3

@gowenfawr is correct, stored PAN would be encrypted, but decrypted in the card production process. But the standard that applies to card issuing and personalization is the PCI Card Production Standard which is way more stringent than PCI DSS:

  • Card Production and Provisioning Logical Security Requirements
  • Card Production and Provisioning Physical Security Requirements

See https://www.pcisecuritystandards.org/document_library and filter by "Card Production".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .