So anywhere where people use compensating controls here?
One,
3.2 specifically the sub requirements about not
storing the prohibited data elements, right,
the magnetic stripe or chip-encoded data,
the card security codes or values or the PINs,
those are the only requirements where you cannot use compensating
controls; you must comply with those requirements as is,
right?
So there's no compensating control for storing the card security code,
there is just not, which means, well, no,
that's caller recordings, and we're not going there.
I guess I've seen some compensating controls for storage
and retention where there's maybe a new policy that went
into effect that limited storage,
but then there's some historical archive of data and just
that act of going and cleaning that out was,
you know, labor intensive,
and so that there were some compensating controls to sort of limit access
to that archive until they could sort of get to an appropriate
maintenance cycle and then go delete all that stuff.
Okay, but it's not common?
It's relatively uncommon.
And the key message there, you can't compensate and control 3.2?
You can't compensate control storage of PAN and CVV2 or anything like that.
Right.
And that's really sensible.
Indeed.