Requirement 3

Question 1

What is requirement 3?

Answer 1

Protect stored account data

Question 2

Storage of account data is kept to

Answer 2

A minimum —– the more you store the more you have to protect

Question 3

What kind of data is not stored after authorization?

Answer 3

Sensitive Authentication Data (SAD)

(including card validation codes/values, (CVCs/CVVs), full track data — from the magnetic stripe or equivalent on a chip PINs, etc)

Question 4

What is PAN?

Answer 4

Primary Account Number

Question 5

What should be done to PAN when it is stored?

Answer 5

It (PAN) needs to be secured

Question 6

What cannot be displayed in full nor copied?

Answer 6

PAN and cardholder data

Question 7

What are used to protect stored account data?

Answer 7

Cryptographic keys – these need to be secured

Question 8

In regard to cryptographic keys for stored account data, what needs to be defined and implemented?

Answer 8

Key management processes and procedures for the entire key lifecycle