Search code examples
securitycachingpci-dssowasp

PCI/DSS: Data at Rest

Would you consider the use of caching products in the category of data at rest?

Solution

  • This is a complex issue, but anything that is held for over 24 hours is considered as "storage" and is under strict controls about how card data is handled - No CV2 for example.

    But you also the data must be on its way to the card transaction and not in the return path after the transaction.

    You probably need to discuss your specific example and exactly what use of which bits of card data you are concerned about with your QSA