C1 (3 points)
https://knobit.org/id/task/dsec-requirements-classification/C1
Also as Turtle · JSON-LD · RDF/XML
| dcterms:license | https://creativecommons.org/licenses/by/4.0/ |
|---|---|
| owl:sameAs | https://bitbucket.org/reffa/ontology/id/task/dsec-requirements-classification/C1 |
| rdfs:label | C1 (3 points) en |
| schema:hasPart | dsec-requirements-classification C1: security codes read out on calls are stored in recordings and transcripts |
| schema:hasPart | dsec-requirements-classification C1: card numbers spoken on calls bring the contact-centre platform into PCI DSS scope |
| schema:hasPart | dsec-requirements-classification C1: a PCI DSS requirement cites the retired v3.2.1 |
| schema:identifier | C1 |
| schema:position | 1 |
| schema:text | Card data on calls, 1 each. (a) Callers paying a loan with another bank's card read out the card number, expiry date and security code, so the recordings (DS-020) and transcripts (DS-021) store sensitive authentication data: under PCI DSS v4.0.1 Req. 3.3.1 it must not be stored after authorisation - its capture is stopped (DTMF masking, an IVR or recording paused) and the stored copies purged or redacted, not classified restricted and kept. (b) PCI DSS applies to VoiceDesk although the bank's own card numbers are tokenised in card management: the PAN spoken on calls brings into scope the recording and transcript stores and their backups, the transcription service, the agents' telephony and desktops, the team leads, QA and complaints readers and the SpeechCo extract - or the card details are kept out of VoiceDesk (DTMF masking or IVR) and the stored ones purged, keeping it out of scope; either path marked proposed for the Head of Cards. (c) RQ-031 cites PCI DSS v3.2.1 Req. 3.2, a retired version: v4.0.1 Req. 3.3.1 is the provision in force. en |