Which PCI DSS requirement addresses protecting stored cardholder data?

Which PCI DSS requirement addresses protecting stored cardholder data?

• A. Encrypt transmission of cardholder data across open, public networks
• B. Maintain a policy that addresses information security for all personnel
• C. Protect stored cardholder data
• D. Track and monitor all access to network resources and cardholder data

Answer: (C)

Protecting cardholder data when it is stored is the focus. PCI DSS has a requirement dedicated to safeguarding stored cardholder data, which covers encrypting data at rest, masking or truncating PAN when displayed, limiting how long data is retained, and using strong cryptographic key management. This targeted protection of data at rest is what this item asks for, rather than protections for data in transit, policy for personnel, or activity logging. The other areas address different parts of the data lifecycle—transmission security, governance, and monitoring—while this one specifically ensures that stored cardholder data is protected.

Protecting cardholder data when it is stored is the focus. PCI DSS has a requirement dedicated to safeguarding stored cardholder data, which covers encrypting data at rest, masking or truncating PAN when displayed, limiting how long data is retained, and using strong cryptographic key management. This targeted protection of data at rest is what this item asks for, rather than protections for data in transit, policy for personnel, or activity logging. The other areas address different parts of the data lifecycle—transmission security, governance, and monitoring—while this one specifically ensures that stored cardholder data is protected.