Data retention and disposal policies for cardholder data storage must include which elements?

Data retention and disposal policies for cardholder data storage must include which elements?

• A. Not storing data at all.
• B. Indefinite retention to support audits.
• C. Limiting data storage to required duration, with specific retention requirements, secure deletion, and a quarterly process to securely delete data exceeding retention.
• D. Storing data in plain text as long as backups are encrypted.

Answer: (C)

Cardholder data should only be stored for the minimum time necessary and disposed of securely when it’s no longer needed. A proper data retention and disposal policy lays out how long card data is kept, the specific retention requirements for different data types, and the secure deletion method used when data reaches its end of life. The best answer also adds a routine, such as a quarterly process, to purge data that has exceeded its retention period. This ensures data isn’t kept longer than required and that all copies, including backups, are securely erased, reducing the risk of exposure. Why this is the right approach: it aligns with PCI DSS guidance to minimize stored cardholder data, define clear retention periods, and use secure deletion methods. Regularly deleting data that has outlived its retention period prevents accumulation of unnecessary sensitive information and closes potential attack vectors. Not storing data at all isn’t always practical for many environments, indefinite retention violates the principle of minimization, keeping data in plain text is inherently insecure, and encryption of backups alone doesn’t substitute for a defined retention and secure disposal process.

Cardholder data should only be stored for the minimum time necessary and disposed of securely when it’s no longer needed. A proper data retention and disposal policy lays out how long card data is kept, the specific retention requirements for different data types, and the secure deletion method used when data reaches its end of life. The best answer also adds a routine, such as a quarterly process, to purge data that has exceeded its retention period. This ensures data isn’t kept longer than required and that all copies, including backups, are securely erased, reducing the risk of exposure.

Why this is the right approach: it aligns with PCI DSS guidance to minimize stored cardholder data, define clear retention periods, and use secure deletion methods. Regularly deleting data that has outlived its retention period prevents accumulation of unnecessary sensitive information and closes potential attack vectors.

Not storing data at all isn’t always practical for many environments, indefinite retention violates the principle of minimization, keeping data in plain text is inherently insecure, and encryption of backups alone doesn’t substitute for a defined retention and secure disposal process.