Checks / Obligations / Protect card payment data
Obligation · 2 controls · 1 laws
Protect card payment data
Anyone who stores, processes or sends card data must lock it down to the card industry's standard.
What to put in place
Scope where card data flows, keep it out of systems that do not need it, and evidence each PCI DSS requirement.
Policy wording you can use
[your organisation] keeps cardholder data only where it is needed, encrypts it in storage and transit, restricts access on a need-to-know basis and has its controls assessed against PCI DSS every year.
Prove it once
Describe or link the evidence that this is in place: the policy, the page, the document reference. It is sealed once and applied to all 2 controls here that take a yes or a document (the rest need their own number or date and are listed after).