PCI Secure Software Lifecycle v1.1

Control Objectives:
7.1 Sensitive production data is only collected and retained on software vendor systems where there is a legitimate business or technical need.
Test Requirements:
7.1 The assessor shall examine vendor evidence and interview personnel to confirm the following: 

Guidance:
To protect the confidentiality of any sensitive production data—that is, sensitive data that is owned by an entity other than the software vendor— and stored on software vendor systems, such data should never be used for purposes other than those for which the data was originally collected. If the software vendor provides services to its stakeholders that could result in the collection of sensitive production data⎯for example, for troubleshooting or debugging purposes⎯then the software vendor should record which specific data elements it collects and retains, and clearly communicate what data elements are collected and why they are collected to its customers and other relevant stakeholders. 
The inventory of sensitive production data retained by the software vendor should include identification of the specific data elements captured, whether storage of each element is permitted, and the security controls required—for example, to protect confidentiality and/or integrity—for each data element during storage and transmission. 

Control Objectives:
7.2 Sensitive production data is protected when retained on software vendor systems and securely deleted when no longer needed.
Test Requirements:
7.2.a The assessor shall examine vendor evidence and interview personnel to confirm that a mature process exists to ensure sensitive production data is protected when retained on software vendor systems and is securely deleted when no longer needed.
7.2.b The assessor shall examine vendor evidence and observe a sample of vendor systems to confirm the following: 

Guidance:
When software vendors collect sensitive production data from their stakeholders—for example, for debugging or other customer support purposes—the vendor should coordinate with its stakeholders to identify which data elements require protection. Vendor stakeholders may have their own definition and associated security requirements for sensitive data, and appropriate protection efforts should be agreed upon by both parties. 
Where the software vendor collects or retains sensitive production data, the software vendor should ensure it is secured—for example, by using robust access control measures and/or strong cryptography with industry-accepted key-management processes. As soon as it is no longer needed for its collected purpose, sensitive production data should be securely deleted such that it is not possible to reconstruct or recover the data from any software vendor system.