1. Purpose
The purpose of this policy is to define the encryption standards for protecting sensitive payment card and financial data processed, transmitted, or stored by Bayarcash, ensuring compliance with PCI DSS and industry best practices.
2. Scope
This policy applies to:
- All systems, applications, and devices that process, transmit, or store cardholder data (CHD) and sensitive authentication data (SAD).
- All employees, contractors, and third-party service providers who handle or have access to sensitive data.
3. Definitions
- Cardholder Data (CHD): Includes primary account number (PAN), cardholder name, expiration date, and service code.
- Sensitive Authentication Data (SAD): Includes full magnetic stripe data, card validation code (CVC/CVV), and PIN blocks.
- Encryption: The process of converting data into unreadable form using cryptographic algorithms to prevent unauthorized access.
4. Policy Statements
4.1 Data Encryption in Transit
- All cardholder data transmitted over open or public networks must be encrypted using strong encryption protocols, such as:
- TLS 1.2 or higher for web and API communications
- IPSec or VPN for network-to-network communication
- Weak protocols (e.g., SSL, TLS 1.0, TLS 1.1) are prohibited.
4.2 Data Encryption at Rest
- Cardholder data stored within Bayarcash systems must be encrypted using AES-256 or an equivalent strong encryption algorithm.
- Encryption keys must be securely stored and managed according to key management procedures.
4.3 Key Management
- Cryptographic keys must be:
- Generated securely using approved methods
- Changed periodically or when suspected compromised
- Access restricted to authorized personnel only
- Stored separately from encrypted data
4.4 End-to-End Encryption (E2EE)
- Sensitive data from the point of entry (POS, web, mobile) must remain encrypted until it reaches the secure Bayarcash processing environment.
4.5 Masking & Truncation
- Full PAN must not be displayed except to authorized personnel with a business need.
- Displayed PAN must be masked (e.g., only last 4 digits visible).
4.6 Payment Application Security
- All payment applications must support encryption of cardholder data in accordance with PCI PTS and PA-DSS standards.
5. Compliance & Monitoring
- Bayarcash conducts regular audits and vulnerability assessments to ensure encryption standards are maintained.
- All systems handling CHD must be in compliance with PCI DSS v4.0 (or latest version).
- Any encryption failures or suspected breaches must be reported immediately to the Information Security Team.
6. Roles & Responsibilities
Information Security Team:
- Implement and maintain encryption controls.
- Monitor compliance and conduct periodic audits.
- Manage encryption key lifecycle and access control.
IT and Operations Teams:
- Ensure encryption is applied consistently across systems and applications.
- Report any system changes impacting encryption compliance.
Employees and Third-Party Providers:
- Comply with encryption procedures and do not bypass or weaken encryption controls.
- Immediately report any suspected security issues or breaches.
7. Exceptions
- Any exception to this policy must be formally approved in writing by the Information Security Officer (ISO).
- Exceptions must include a documented risk assessment and mitigation plan.
8. Enforcement
Non-compliance with this policy may result in disciplinary action, up to and including termination, as well as legal or regulatory consequences.
9. Policy Review
This policy is reviewed at least annually or whenever PCI DSS requirements or Bayarcash systems change.