350-201 · Question #114
A company recently started accepting credit card payments in their local warehouses and is undergoing a PCI audit. Based on business requirements, the company needs to store sensitive authentication…
The correct answer is C. post-authorization by non-issuing entities if the data is encrypted and securely stored. PCI DSS defines strict conditions for how sensitive authentication data may be stored post-authorization, particularly distinguishing between issuing and non-issuing entities.
Question
A company recently started accepting credit card payments in their local warehouses and is undergoing a PCI audit. Based on business requirements, the company needs to store sensitive authentication data for 45 days. How must data be stored for compliance?
Options
- Apost-authorization by non-issuing entities if there is a documented business justification
- Bby entities that issue the payment cards or that perform support issuing services
- Cpost-authorization by non-issuing entities if the data is encrypted and securely stored
- Dby issuers and issuer processors if there is a legitimate reason
How the community answered
(21 responses)- A5% (1)
- B5% (1)
- C90% (19)
Why each option
PCI DSS defines strict conditions for how sensitive authentication data may be stored post-authorization, particularly distinguishing between issuing and non-issuing entities.
A documented business justification alone does not satisfy PCI DSS requirements for non-issuing entities - encryption and secure storage are also mandatory, not optional.
This option correctly describes issuer permissions but does not apply to the company in the question, which is a non-issuing entity accepting payments at warehouses.
For non-issuing entities that have a legitimate business requirement to retain sensitive authentication data post-authorization, PCI DSS mandates that the data must be encrypted and stored securely as the minimum compliance condition. This combination of encryption and secure storage is the specific technical safeguard required when a non-issuer stores this category of data, making it the compliant approach for the warehouse scenario described.
Issuers and issuer processors have their own storage permissions, but this option does not address the non-issuing entity scenario presented in the question.
Concept tested: PCI DSS sensitive authentication data retention rules
Source: https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf
Topics
Community Discussion
No community discussion yet for this question.