Cardholder data
The payment card information PCI DSS is designed to protect, chiefly the primary account number.
The card number is the pivot: wherever it is stored, processed, or transmitted falls into scope, along with anything connected to those systems without adequate segmentation.
Sensitive authentication data such as the security code and full magnetic stripe contents must never be stored after authorization, regardless of encryption.
Where this comes up
Cardholder data sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
PCI DSS The security standard any organization handling payment card data must meet, set by the card brands. Data classification Sorting data into categories by sensitivity so that protection can be applied proportionately. Network segmentation Dividing a network into zones with controlled traffic between them, so a compromise in one does not reach the others.