While classifying credit card data related to Payment Card Industry Data Security Standards (PCI-DSS), which of the following is a PRIMARY security requirement?

Processor agreements with cardholders are a contractual or business relationship concern, not a primary PCI-DSS technical security requirement for protecting cardholder data.

PCI-DSS does not mandate a three-year data retention period; in fact, it encourages minimizing data retention and prohibits storing sensitive authentication data after authorization.

PCI-DSS Requirement 3 explicitly mandates the protection of stored cardholder data through strong cryptography, and Requirement 4 requires encryption of cardholder data transmitted across open or public networks. Encryption is a foundational control ensuring that even if data is compromised, it remains unreadable and unusable to unauthorized parties, making it the primary security requirement for PCI-DSS compliance.

While PCI-DSS does address secure disposal of media containing cardholder data (Requirement 9), specific card disposal methodology is a physical security sub-requirement, not the primary security requirement when classifying credit card data.