C1 (3 points)
https://knobit.org/id/task/dsec-regulatory-requirements/C1
Also as Turtle · JSON-LD · RDF/XML
| dcterms:license | https://creativecommons.org/licenses/by/4.0/ |
|---|---|
| owl:sameAs | https://bitbucket.org/reffa/ontology/id/task/dsec-regulatory-requirements/C1 |
| rdfs:label | C1 (3 points) en |
| schema:hasPart | dsec-regulatory-requirements C1: PCI DSS cited for IBAN encryption |
| schema:hasPart | dsec-regulatory-requirements C1: the PAN copy in the warehouse is outside RQ-004's scope |
| schema:hasPart | dsec-regulatory-requirements C1: what the copy brings into PCI DSS scope |
| schema:identifier | C1 |
| schema:position | 1 |
| schema:text | Each regulation's scope, 1 each. (a) CT-005, IBAN column encryption in core banking, is claimed as PCI DSS Req. 3.5.1 evidence: IBANs are not cardholder data, so PCI DSS does not apply to them - the claim is removed and the control mapped to GDPR Art. 32 and banking secrecy instead. (b) The data inventory shows the PAN copied nightly into the legacy warehouse (DS-007), while RQ-004 (PAN unreadable wherever stored) lists only DS-004: the copy is outside the requirement's scope. (c) The answer traces what the copy brings into PCI DSS scope - the warehouse store, the WH_CARD_LOAD job that writes it, the card analytics and Finance BI readers, and its 35-day backups - or proposes removing or truncating the PAN there so the warehouse stays out of scope; either marked proposed for the Head of Cards. Flagging the column alone earns (b), not (c). en |