If there is an authorized business need, how should cardholder data be protected?

• A. It can be copied to local drives for convenience.
• B. It must be encrypted using any encryption method chosen by the user.
• C. It must be protected only during transmission.
• D. It must be protected in accordance with all applicable PCI DSS Requirements.

Answer: (D)

Cardholder data must be protected wherever it is stored, processed, or transmitted, and authorized business use does not exempt you from applying the full set of PCI DSS protections. Following all applicable PCI DSS Requirements ensures you implement the complete set of controls—strong access controls, proper encryption with validated methods and robust key management, secure handling across systems and networks, logging, monitoring, and vulnerability management. This holistic approach is necessary because data can be at risk in multiple stages and locations, not just during transmission.

Relying on a single protection like encryption alone (and especially using any method chosen by a user) isn’t sufficient, since PCI DSS requires specific, validated controls and proper key management. Protecting data only during transmission misses risks when data is at rest or during processing. Copying data to local drives creates additional exposure and is generally not allowed under PCI DSS unless explicitly justified and properly controlled. Therefore, protecting cardholder data in accordance with all applicable PCI DSS Requirements is the correct approach.