Куда я попал?
Framework № PCI DSS 4.0 от 01.03.2022
Payment Card Industry Data Security Standard (RU)
Requirement 3.3.1.2
Для проведения оценки соответствия по документу войдите в систему.
Список требований
Похожие требования
Приказ ФСТЭК России № 21 от 18.02.2013 "Состав и содержание мер по обеспечению безопасности персональных данных, необходимых для обеспечения каждого из уровней защищенности персональных данных":
ОПС.4
ОПС.4 Управление временными файлами, в том числе запрет, разрешение, перенаправление записи, удаление временных файлов
Framework № PCI DSS 4.0 от 01.03.2022 "Payment Card Industry Data Security Standard":
Requirement 3.3.1.2
3.3.1.2
Defined Approach Requirements:
The card verification code is not retained upon completion of the authorization process.
Customized Approach Objective:
This requirement is not eligible for the customized approach.
Applicability Notes:
The card verification code is the three- or four-digit number printed on the front or back of a payment card used to verify card-not-present transactions.
Defined Approach Testing Procedures:
Defined Approach Requirements:
The card verification code is not retained upon completion of the authorization process.
Customized Approach Objective:
This requirement is not eligible for the customized approach.
Applicability Notes:
The card verification code is the three- or four-digit number printed on the front or back of a payment card used to verify card-not-present transactions.
Defined Approach Testing Procedures:
- 3.3.1.2 Examine data sources, to verify that the card verification code is not stored upon completion of the authorization process.
Purpose:
If card verification code data is stolen, malicious individuals can execute fraudulent Internet and mail-order/telephone-order (MO/TO) transactions. Not storing this data reduces the probability of it being compromised.
Examples:
If card verification codes are stored on paper media prior to completion of authorization, a method of erasing or covering the codes should prevent them from being read after authorization is complete. Example methods of rendering the codes unreadable include removing the code with scissors and applying a suitably opaque and unremovable marker over the code
Data sources to review to ensure that the card verification code is not retained upon completion of the authorization process include, but are not limited to:
If card verification code data is stolen, malicious individuals can execute fraudulent Internet and mail-order/telephone-order (MO/TO) transactions. Not storing this data reduces the probability of it being compromised.
Examples:
If card verification codes are stored on paper media prior to completion of authorization, a method of erasing or covering the codes should prevent them from being read after authorization is complete. Example methods of rendering the codes unreadable include removing the code with scissors and applying a suitably opaque and unremovable marker over the code
Data sources to review to ensure that the card verification code is not retained upon completion of the authorization process include, but are not limited to:
- Incoming transaction data.
- All logs (for example, transaction, history, debugging, error).
- History files.
- Trace files.
- Database schemas.
- Contents of databases, and on-premise and cloud data stores.
- Any existing memory/crash dump files.
Приказ ФСТЭК России № 17 от 11.02.2013 "Требования о защите информации, не составляющей государственную тайну, содержащейся в государственных информационных системах":
ОПС.4
ОПС.4 Управление временными файлами, в том числе запрет, разрешение, перенаправление записи, удаление временных файлов
Связанные защитные меры
Ничего не найдено
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.