FAQ #1222 Diff

For PCI DSS requirement 3.4 and protection of specificinformation about protecting different elements of cardholder data (CHD)elements, please refer to the table included on page 7 oftables provided in the "PCI DSS Applicability Information" section in the PCI DSS. The tabletables illustrates that, if the cardholder name, expiration date, or service code is recorded in conjunction with the PAN, these additional cardholder data elements are required toservice code, and/or expiration date are stored, processed or transmitted with the PAN, or are otherwise present in the cardholder data environment, they must be " protected "in accordance with applicable PCI DSS requirements.

This means that all applicable PCI DSS requirementsmust be adhered to for protection of those cardholder data elements stored in conjunction with the PAN, such as firewall, patches, anti-virus, access controls, policies and procedures, etc., but, such as firewalls, patches, anti-virus, access controls, policies and procedures, etc., must be applied for protection of those cardholder data elements. However, only the PAN itself must be rendered unreadable . Please note that ifin accordance with Requirement 3.4.

If these other elements of cardholder data (that is, cardholder name, expiry date and/or service code) are present without any PAN, then PCI DSS would not apply to those elements.