PCI Compliance Requirement: Stored Cardholder Data on Paper

For businesses that are still storing cardholder data on paper, are you really PCI Compliant? Meeting requirement 9, Restricting physical access to cardholder data,  is a lot harder than you may think. Here are some key questions you may face in the event of an audit, which is required in the event of a data breach.

locked file stored card data

  • Do you have a secure storage area exclusively for sensitive payment data?
  • Can you show an audit trail of everyone who accessed the secure area where the card data is stored, with date and time?
  • Is that area restricted to only those personnel who need access to that information?
  • Do you have a log to maintain a physical audit trail of visitor information and activity in any area that payments are processed, including visitor name and company, and the onsite personnel authorizing physical access?
  • Do you have a visitor badge system that expires for all visitors authorized to enter areas where cardholder data is processed or maintained?
  • Do you have an audit trail for the documents- created, removed from storage, and returned to storage, with names and dates?

Let’s face it, the requirements for PCI compliance are so cumbersome what merchant would want to store card data on paper? The argument that PCI Compliance paperwork takes more time for online solutions than with desktop terminals may be true, but the daily operational efficiencies and security gained far outweigh any extra paperwork.