PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 3 / c3.2
Foundational Data ProtectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.2 Minimize account data storage and do not retain SAD

Minimize stored account data by applying retention and purge policies, and ensure that sensitive authentication data (SAD) is not retained after authorization.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: High Applies to CDE: Yes

Requirement 3

Protect Stored Account Data

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

3.2 Storage of account data is kept to a minimum
  • 3.2.1 Account data storage minimized via retention and disposal policy Your responsibility
3.3 Sensitive authentication data (SAD) is not stored after authorization
  • 3.3.1 SAD not stored after authorization, even if encrypted Covered
  • 3.3.2 SAD stored before authorization is encrypted with strong crypto Covered
  • 3.3.3 Issuer SAD storage: minimal, encrypted, justified (issuers only) Covered

How to implement on AWS

Define retention policies with S3 Lifecycle and DynamoDB TTL to purge account data when it is no longer needed. Avoid storing SAD (full track, CVV, PIN). Discover inadvertent storage of account data with Amazon Macie. Document the business justification, retention period, and secure deletion process.

Practical implementation

How this control is implemented in each reference architecture:

Store the least account data for the shortest time, purge it automatically, and prove that sensitive authentication data (SAD) is never retained after authorization.

  1. Apply S3 Lifecycle rules and DynamoDB TTL on the data tier so account data is purged automatically once past its documented retention window.
    Data tier (CDE) Amazon S3 DynamoDB
  2. Run Amazon Macie in the account to confirm no SAD (full track, CVV, PIN) and no stray PAN are stored outside the intended location.
    Account-wide data discovery Amazon Macie
  3. Document the retention period, business justification, and secure-deletion method as the policy artifact the assessor examines.
    Data retention policy

How to validate: Lifecycle/TTL policies are active on CDE stores, and a current Macie job reports no SAD and PAN only in the approved location.

Avoid: Keeping account data 'just in case'. Every extra copy expands scope and risk; retain only what a documented business need requires and purge the rest.

Single-account, 3-tier →

Discover account data centrally across every CDE account and enforce retention as code, so minimization and no-SAD are consistent org-wide.

  1. Enable Amazon Macie from the delegated administrator in the security tooling account to scan S3 across all CDE accounts from one place.
    Security tooling account → PCI OU Amazon Macie AWS Organizations
  2. Deploy retention policies (S3 Lifecycle / DynamoDB TTL) as code to each CDE account so purge behavior is identical everywhere.
    Each CDE workload account Amazon S3 DynamoDB CloudFormation
  3. Centralize retention and discovery findings in Security Hub for a single compliance view.
    Security tooling account Security Hub

How to validate: The delegated-admin Macie shows no SAD across accounts, and each CDE account has the deployed retention policy with matching purge history.

Avoid: Running Macie ad hoc per account. Centralize discovery from the delegated admin so coverage is complete and findings are comparable.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserveinterview

Testing procedures

  • Examine data retention and disposal policies and interview personnel to verify processes limit account data storage and retention to business/legal/regulatory needs (3.2.1.a); examine records to confirm stored amount and retention do not exceed the policy (3.2.1.b).
  • Observe the mechanisms used to render account data unrecoverable (3.2.1.c).
  • If SAD is received, examine policies, procedures, and configurations to verify SAD is not stored after authorization and is rendered unrecoverable (3.3.1.a, 3.3.1.b).

Evidence in AWS

  • S3 Lifecycle / DynamoDB TTL policies configured for purging.
  • Amazon Macie findings confirming absence of SAD and controlled PAN location.
  • Documented account data retention and disposal policy.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 3.2 — Account data is retained only where necessary and for the least amount of time needed, and is securely deleted or rendered unrecoverable when no longer needed.

AWS services

Amazon Macie Amazon S3 Amazon DynamoDB AWS Config

Learning resources

References

  • AWS Security Maturity Model: Sensitive data discovery