Req 3: Protect stored cardholder data. What is the main objective of this requirement?

Req 3: Protect stored cardholder data. What is the main objective of this requirement?

• A. Encrypt all data in transit only
• B. Store backups of tables securely
• C. Protect stored cardholder data
• D. Audit system logs regularly

Answer: (C)

The main idea being tested is safeguarding cardholder data when it is stored. Requirement 3 is about ensuring that cardholder data at rest is protected from unauthorized access, even if someone gains access to the systems where it’s stored. This means keeping stored data unreadable and secure through methods like strong encryption, masking or truncation of PAN where appropriate, and careful data handling, including robust key management and strict access controls. It also covers secure protection of backups and archived data, and proper disposal when no longer needed. Protecting data in transit is handled by other controls, so encrypting data as it moves across networks isn’t the focus of this requirement. The option about securing backups of tables is related, but the main objective is broader: it’s about protecting all stored cardholder data wherever it resides, not just backups. Auditing system logs is about monitoring and accountability, not about keeping stored data unreadable and inaccessible. So, protecting stored cardholder data best captures the intent: render data at rest unreadable and defend it against exposure through encryption, masking, and sound data-management practices.

The main idea being tested is safeguarding cardholder data when it is stored. Requirement 3 is about ensuring that cardholder data at rest is protected from unauthorized access, even if someone gains access to the systems where it’s stored. This means keeping stored data unreadable and secure through methods like strong encryption, masking or truncation of PAN where appropriate, and careful data handling, including robust key management and strict access controls. It also covers secure protection of backups and archived data, and proper disposal when no longer needed.

Protecting data in transit is handled by other controls, so encrypting data as it moves across networks isn’t the focus of this requirement. The option about securing backups of tables is related, but the main objective is broader: it’s about protecting all stored cardholder data wherever it resides, not just backups. Auditing system logs is about monitoring and accountability, not about keeping stored data unreadable and inaccessible.

So, protecting stored cardholder data best captures the intent: render data at rest unreadable and defend it against exposure through encryption, masking, and sound data-management practices.