The Payment Card Industry Data Security Standard (PCI DSS) defines Cardholder Data (CHD) as information that must be safeguarded to prevent fraud and unauthorized access. This includes Primary Account Numbers (PAN), cardholder names, expiration dates, and service codes. The standard outlines requirements for how organizations store, process, and transmit CHD to ensure security and compliance.
What CHD Includes
Cardholder Data encompasses several key pieces of information:
- Primary Account Numbers (PAN): The unique identifier for a payment card.
- Cardholder Names: The name associated with the payment card.
- Expiration Dates: The month and year when the payment card expires.
- Service Codes: Information about the payment card type and issuer.
Sensitive Authentication Data
In addition to CHD, the PCI DSS also addresses Sensitive Authentication Data (SAD), which includes:
- Full Track Data: Magnetic-stripe data or equivalent on a chip.
- Card Verification Codes: Security codes like CVV or CVC.
- PINs/PIN Blocks: Personal Identification Numbers or encrypted PIN data.
Compliance Requirements
Organizations handling CHD must adhere to the PCI DSS guidelines to ensure data security. These requirements include:
- Encryption: Protecting CHD with strong encryption methods.
- Access Controls: Limiting access to CHD to authorized personnel only.
- Monitoring: Regularly monitoring and testing security systems for vulnerabilities.