3.3.1.1 Full track data not retained after authorization
No complete track contents (from the magnetic stripe, the equivalent chip data, or another source) may be kept once authorization completes. Applicability: in the ordinary course of business an entity may need to keep only four elements taken from the track: the PAN (primary account number), the cardholder name, the service code and the expiration date, and should store just those it needs, securely. Guidance lists data sources to check, such as inbound transaction feeds, every kind of log (transaction, history, debug and error), history and trace files, schemas of databases, the contents of databases and of on-premise or cloud data stores, and memory or crash dumps. Objective under the customized approach: none, this requirement cannot be met through the customized approach.
Source: PCI DSS v4.0.1, 3.3.1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Samples of transaction, debug and error logs reviewed for track data · SIEM / log platform
- Review of memory and crash dump files for track content · Document repository
governing documentDocuments that govern the control
- Data discovery tool output searching for track 1 and track 2 patterns across stores and logs · Policy repository / GRC workspace
- Database schema listing showing no field retaining full track data · Document repository
First move
Common gaps auditors find
- Legacy POS or switch logs retain full track 2 data
- Cloud data stores or history files excluded from the discovery scope
- Fields retained beyond the four permitted track elements
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet3.3.1 SAD not retained after authorization, even encrypted · 3.3.1.2 Card verification code not retained after authorization