PCI DSS requirement 2.1 emphasizes the need for organizations to safeguard any cardholder data they store. This entails implementing specific security measures to reduce the risk associated with storing sensitive data. These may include minimizing the amount of data you store (do not store data unless it’s necessary), securely deleting data that’s no longer needed, and using strong cryptographic controls when data must be stored.
For example, sensitive data elements such as the card verification code or value (three or four-digit number printed on the front or back of payment cards) must never be stored after authorization. Other cardholder data elements, such as the PAN (Primary Account Number), must be rendered unreadable anywhere it is stored, which typically involves cryptographic techniques like encryption, tokenization, or truncation.
When transmitting cardholder data over public networks (like the internet), there’s a risk that the data could be intercepted and stolen. Requirement 2.2 mandates that organizations encrypt this data during transmission to protect it from potential eavesdropping or data tampering.
The encryption works by transforming the information into a code that can only be accessed with the right decryption key. This means that even if the data is intercepted during transmission, it would be unreadable and thus useless to anyone without the decryption key.
The standard doesn’t specify a particular encryption method, but it does require the use of strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks. Some common protocols used for this purpose include IPSEC, SSL/TLS, and SSH.
By adhering to these requirements, organizations ensure that cardholder data is protected both at rest and in transit, significantly reducing the likelihood of a data breach.