What it means
Sensitive authentication data handling prevents storage of prohibited authentication data after authorization and tightly controls any transient processing needed to complete a payment.
Why it matters
Card verification values, full track data, and PIN-related data create severe exposure and generally cannot be protected merely by encrypting and retaining them after authorization.
Practical focus
- Identify every system, log, queue, memory store, recording, troubleshooting process, and provider that could capture sensitive authentication data.
- Design applications and support procedures to avoid storage, mask diagnostic output, and purge transient data promptly.
- Test payment, error, retry, failover, logging, and support scenarios for prohibited data.
- Preserve this evidence: Retain approved definitions, decisions, operating records, exceptions, test results, and change history that show how Sensitive Authentication Data Handling works over time.
- Exercise this failure scenario: A debug mode records card verification data during failed transactions and the log is retained after authorization.
Common mistakes
- Using Sensitive Authentication Data Handling as a label without defining its scope, owner, decision criteria, and expected evidence.
- Treating a diagram, policy, tool screen, or meeting as proof that Sensitive Authentication Data Handling operates consistently in real work.
- Optimizing for a one-time review while leaving normal operating decisions, exceptions, and handoffs uncontrolled.
- Testing only the expected path and never rehearsing this failure condition: A debug mode records card verification data during failed transactions and the log is retained after authorization.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: