Requirement 3 is all about protecting stored cardholder data.
It is split into seven sections.
Firstly,
a requirements to have retention policies to minimize
the storage of cardholder data.
Secondly,
an absolute prohibition on storing sensitive
authentication data after authorization,
unless you are an issuer of cards, or support the issuing of cards.
Next, a frequently misunderstood requirement,
but concerns the display of card numbers on screens and on printouts.
Then we come to encryption.
Firstly,
a requirement that all cardholder data stored must be
encrypted or otherwise protected.
Next, there are a couple of requirements detailing how to do encryption properly,
and then finally, are friend policies and procedures at the end.
If we look at our sample network,
we need to determine where cardholder data may be stored to understand
which components this requirement will apply to,
and there are three places where we could find cardholder data here.
The database server is the most obvious location,
and in my experience,
point of sale systems and local servers and retail stores are also
good places where you will find cardholder data.
Sometimes it's stored deliberately, sometimes accidentally.
I've assumed in this example that neither the web server nor the payment gateway
stores cardholder data after they've processed it; however,
if I was carrying out an assessment of this organization,
I'd have a good look at those systems,
because you would often accidentally find cardholder data stored there.
Well, actually your finding it wouldn't be an accident,
but the data would've been stored there accidentally.
Firstly, requirement 3.1 ; it's a simple one.
If you don't need cardholder data, don't keep it.
So the first thing you need is a retention policy that says what
cardholder data you will keep and how long you'll keep it for,
and why it's necessary to keep the data for the length
of the period you've determined.
So that means you need a written business justification,
which might refer to legal, regulatory, or other business reasons.
And then given you have a retention policy,
cardholder data that falls outside of this retention policy must be deleted.
And PCI DSS requires that you have a documented process for secured deletion,
but the deletion process executes quarterly,
and it securely deletes all cardholder data that falls
outside the defined retention period.
The QSA is going to look at all your documented processes to make sure
they cover all the requirements here and will interview people to make
sure that both processes are working and to understand all the locations
where card holder data is stored.
The QSA will then physically look at those stores of
cardholder data to validate there is no cardholder data
which exceeds the retention period.
Finally, do I want to watch the processes used to delete the cardholder data.