PCI Compliant Hosting: Data Storage Guidelines

Posted 8.24.12 by
wpadmin
Blog

Protecting stored cardholder data is the end goal of the PCI DSS (Payment Card Industry Data Security Standards) compliance requirements, and data storage is one important aspect of that goal.

The PCI SSC (Payment Card Industry Security Standards Council) has a handy guide to PCI DSS Data Storage Do’s and Don’ts explaining the best practices for the benefit of merchant and financial institutions that need advice on how to handle customer cardholder data.

When it comes to basic cardholder data storage, the PCI SSC recommends:

  • Merchants must understand the flow of payment card data throughout the entire transaction process
  • Payment card terminals must comply with PCI PIN (Personal ID Number) PTS (Transaction Security) requirements
  • Payment apps must comply with PA-DSS (Payment Application Data Security Standard)
  • Retain cardholder data only if authorized, and ensure its protection
  • Encrypt (use strong cryptography) all stored cardholder data, and use other security technologies to minimize risk
  • Check that all third parties who process cardholder data also comply with PCI standards.

A few ‘data don’ts’ include:

  • Don’t store cardholder unless absolutely necessary (limiting scope of applicable compliance requirements)
  • Don’t store sensitive authentication data found on payment card’s chip or magnetic stripe, including the verification code on the back or front of the card after authorization
  • Don’t allow payment terminals to print out personally identifiable payment card data
  • Don’t have servers outside of locked, fully-secured and access-controlled rooms
  • Don’t allow unauthorized people to access stored cardholder data

PCI Compliant Hosting White PaperAs a basic high-level overview, these guidelines are clear and intent on protecting data from unauthorized access and potential data leakage. A more in-depth analysis of the PCI DSS requirements from a PCI hosting provider perspective can be found in our PCI Compliant Hosting white paper that lists each technical requirement and outlines what a PCI compliant data center should entail. Security and data protection are paramount to merely checking off compliance requirements, and our white paper shows you how to achieve both.

Additional PCI resources you may find helpful:

References:

PCI DSS Data Storage Do’s and Don’ts (PDF)

About Otava

Otava provides the secure, compliant hybrid cloud solutions demanded by service providers, channel partners and enterprise clients in compliance-sensitive industries. By actively aggregating best-of-breed cloud companies and investing in people, tools, and processes, Otava’s global footprint continues to expand. The company provides its customers in highly regulated disciplines with a clear path to transformation through its effective solutions and broad portfolio of hybrid cloud, data protection, disaster recovery, security and colocation services, all championed by an exceptional support team. Learn more at www.otava.com.

Get started with Otava now!

  • This field is for validation purposes and should be left unchanged.