3.3 Sensitive authentication data (SAD) is not stored after authorisation
How to meet it
Never store full track data, card verification codes, or PINs after authorisation.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 3.3, in plain English.
3.3.1Sensitive authentication data is not retained after authorization, even encrypted, and any SAD received is made unrecoverable once authorization completes.
3.3.1.1The full contents of any track are not stored after authorization finishes.
3.3.1.2The card verification code is not stored after authorization finishes.
3.3.1.3The PIN and PIN block are not stored after authorization finishes.
3.3.2Any SAD held electronically before authorization completes is encrypted with strong cryptography.
3.3.3For issuers, any stored SAD is limited to a legitimate issuing need, kept secure, and encrypted with strong cryptography.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Cryptography and key management policyUse for ISO 27001 A.8.24, secure authentication, encryption, SOC 2 Security, and PCI DSS encryption requirements.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Password and authentication policyUse for ISO 27001 A.5.17, A.8.5, SOC 2 Security, and PCI DSS requirement 8 authentication controls.
Open the control-to-policy map← 3.2 Storage of account data is kept to a minimum3.4 Access to displays of full PAN and ability to copy PAN is restricted →
Back to Requirement 3, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.