Which standard governs protection of credit card data during storage, processing, and transmission?

• A. COPPA
• B. Payment Card Industry Data Security Standard (PCI DSS)
• C. PIPEDA
• D. Common Criteria (CC)

Answer: (B)

Protecting cardholder data across storage, processing, and transmission is governed by the PCI DSS. This security standard, created by the Payment Card Industry Security Standards Council, lays out specific requirements to ensure card data is handled securely at every stage. It covers building and maintaining a secure network, protecting stored card data through encryption and access controls, implementing strong authentication and access limitations, regularly monitoring and testing systems, and maintaining an information security policy. It applies to all entities that store, process, or transmit cardholder data, including merchants, processors, and service providers, and addresses protections for data at rest, in use, and in transit.

Other standards have different scopes: COPPA centers on protecting children’s privacy online; PIPEDA governs personal data privacy in commercial activities in Canada; Common Criteria is an evaluation framework for the security of IT products and systems rather than a comprehensive standard for protecting card data specifically. The PCI DSS is the one focused on safeguarding credit card data throughout its lifecycle.