NIST 800-88: Information Deletion Strategies

Secure Data Erasure Requirements (3.1,3.2,9.9.2,10.7)

PCI-DSS requires all entities that process, store or transmit card data to implement strict security measures to protect this information. This includes specific requirements for secure data erasure, ensuring that any cardholder data that is no longer needed is deleted so that it cannot be recovered.

Point 3.1: Data Retention and Secure Erasure Policy

Definition and scope: This point requires entities to define a clear policy on data retention, specifying how long card data should be retained and when it should be deleted. The policy should ensure that data is securely destroyed once it is no longer needed for legal or business purposes.
Implementation: Organizations must implement erasure procedures that prevent the recovery or reconstruction of deleted data, using methods approved by the standard.

Point 3.2: Prohibition of Storage of Sensitive Data

Definition and scope: Prohibits the storage of sensitive authentication data after authorization, including full magnetic stripe data, service code, and card security code (CVV2).
Implementation: Requires the secure deletion of this data if it is inadvertently stored, ensuring that no residue remains that can be exploited.

Point 9.8.2: Destruction of Unused Data

Definition and scope: Focuses on the secure destruction of unused data media, such as hard drives, USBs and paper, that contain cardholder data.
Implementation: Entities must use physical or electronic destruction methods that make it impossible to recover or reconstruct the information.

Point 10.7: Maintenance of Audit Records

Definition and scope: This point requires the retention of audit histories for a minimum of one year, with the last three months easily accessible.
Implementation: Includes ensuring that secure data erasure actions are properly recorded and documented within audit systems, providing evidence of compliance with data security practices.

Verification and Documentation

It is crucial to document all secure erasure actions and procedures, including the methodology used and confirmation that data has indeed been deleted. This documentation must be available for PCI-DSS compliance audits.

Compliance and Audit

Adhering to PCI-DSS secure erase requirements is not only critical to protecting sensitive cardholder information, but also to avoid penalties and ensure continuity in payment processing. Regular audits and penetration tests help verify effective compliance with these practices.