FAQ #1222 Diff

For PCI DSS requirement 3.4 and protection of specific cardholder data (CHD) elements, please refer to the table included in the PCI DSS on page 2 (www.pcisecuritystandards.org)on page 7 of the PCI DSS. The table illustrates that, if the cardholder name, expiration date, or other cardholder dataservice code is recorded in conjunction with the PAN, even if the PAN is rendered unreadable, these additional cardholder data elements are still required to be "protected". This means that all other requirements in the PCI DSSapplicable PCI DSS requirements must be adhered to for protection of those cardholder data elements stored in conjunction with the PAN, such as firewall, patches, anti-virus, access controls, policies and procedures, etc., but only the PAN must be rendered unreadable. Please note that if the PAN is not stored, processed, or transmitted, even if other non-sensitive cardholder data is stored,these other elements of cardholder data (that is, cardholder name, expiry date and/or service code) are present without any PAN, then PCI DSS doeswould not apply to those elements.