What is cardholder data under PCI?

Cardholder data refers to any information contained on a customer’s payment card. The data is printed on either side of the card and is contained in digital format on the magnetic stripe embedded in the backside of the card. Some payment cards store data in chips embedded on the front side.

What is PCI account data?

A: The PCI Security Standards Council (SSC) defines ‘cardholder data’ as the full Primary Account Number (PAN) or the full PAN along with any of the following elements: Cardholder name. Expiration date. Service code.

Why is CDE so important to PCI DSS?

An organization’s CDE is only the starting point to determine the overall PCI DSS scope. Accurate PCI DSS scoping involves critically evaluating the CDE and CHD flows, as well as all connected-to and supporting system components, to determine the necessary coverage for PCI DSS requirements.

What card data is covered by PCI DSS?

Nearly all payment card and cardholder information are subject to PCI protection — most notably, information on credit cards (name, number, etc.) and accounts connected to them. In practice, this means many, if not most, companies that process payments are subject to some form of PCI compliance.

What is a cardholder data environment?

CDE: Acronym for “cardholder data environment.” The people, processes and technology that store, process, or transmit cardholder data or sensitive authentication data.

What does cardholder data consist of?

Cardholder data includes the primary account number (PAN) along with any of the following data types: cardholder name, expiration date or service code. A service code is a three- or four-digit number on cards that use a magnetic-stripe.

What is a cardholder environment?

A cardholder data environment (CDE) is a computer system or networked group of IT systems that processes, stores and/or transmits cardholder data or sensitive payment authentication data. A CDE also includes any component that directly connects to or supports this network.

What are the 4 things PCI DSS covers?

The 12 requirements of PCI DSS are:

• Install and maintain a firewall configuration to protect cardholder data.
• Do not use vendor-supplied defaults for system passwords and other security parameters.
• Protect stored cardholder data.
• Encrypt transmission of cardholder data across open, public networks.

Is cardholder data personal data?

Where cardholder data includes any information that could be used to identify the individual, then it is personal data as defined by the GDPR.

Do acquirers need to be PCI compliant?

Acquirers can be a good source on current requirements since they must also adhere to PCI standards. Educational offerings vary and can include webinars, eBooks, online and in-person trainings, compliance guides, checklists, and other useful resources.

What is the simple rule to protect cardholder data?

Protect stored cardholder data. This rule states that any cardholder data stored on your network must be protected. That typically means perimeter defenses like the firewall mentioned above, along with encryption of cardholder data stored at rest on your network. 4.

What makes up cardholder data?

Is your cardholder data environment compliant with PCI standards?

Ensuring a company’s cardholder data environment (CDE) is compliant with PCI standards is no easy task, however, and often requires unanticipated additional resources and ongoing efforts to maintain.

What is the cardholder data Environment (CDE)?

The cardholder data environment (CDE) is comprised of people, processes and technologies that store, process, or transmit cardholder data or sensitive authentication data. “System components” include network devices, servers, computing devices, and applications (page 10 of the PCI DSS).

What is cardholder data (PCI SSC)?

According to the PCI Security Standards Council (PCI SSC), cardholder data includes the Primary Account Number (PAN) of the credit or debit card, either by itself or alongside one of the following: What is Sensitive Authentication Data (SAD)?

What are the PCI DSS security requirements?

The PCI DSS security requirements apply to all system components included in or connected to the cardholder data environment. The cardholder data environment (CDE) is comprised of people, processes and technologies that store, process, or transmit cardholder data or sensitive authentication data.