3.2.2 For PAN storage, the business justification is documented.
Defined Approach Requirements
3.2.2 For PAN storage, the business justification is documented.
Customized Approach Objective
The business need for storing PAN is documented.
Defined Approach Testing Procedures
3.2.2 Interview personnel and examine documentation to verify that the business justification for PAN storage is documented.
Purpose
Without a documented business need and retention policy, PANs could be stored without a defined retention period, which could lead to unnecessarily storing PANs, which increases the risk in case of a compromise.
Good Practice
The business justification for PAN storage should be documented as part of the data retention policy.
purpose
Do not store sensitive authentication data after authorization (even if encrypted).
compliance strategies
- Data discovery scans
- Automated deletion routines
typical policies
- Sensitive Data Handling Policy
common pitfalls
- SAD stored post-authorization
- No automated deletion
type
Technical/Process Control
difficulty
High
key risks
- Regulatory fines, increased breach risk
recommendations
- Automate SAD deletion and monitor storage
Eligible SAQ
- SAQ-D MERCHANT
- SAQ-D SERVICE PROVIDER
Your perspective on this PCI DSS requirement matters! Share your implementation experiences, challenges, or questions below. Your insights help other organizations improve their compliance journey and build a stronger security community.Comment Policy