Answer

PCI DSS does not define a CVV test. The term describes checks that verify an entity does not store the card verification value after authorization. Requirement 3.2.1 of PCI DSS v4.0 states that entities must not store sensitive authentication data after authorization, even if encrypted. Sensitive authentication data includes the CAV2, CVC2, CVV2, and CID codes.

CVV Testing Meeting PCI DSS Requirements

What CVV Data Is

The CVV2 is a 3-digit code printed on the back of a Visa, Mastercard, or Discover card. The CID is a 4-digit code on the front of an American Express card. The issuer checks this code during the authorization request. The code is separate from the primary account number.

CVV Testing: How to Follow PCI DSS Guidelines

PCI DSS Rules on CVV Storage

  • Requirement 3.2.1: Do not store sensitive authentication data after authorization.
  • Requirement 3.2.2: If SAD is stored before authorization, render it unrecoverable after authorization.
  • Requirement 3.3.1: Mask the PAN when displayed.
  • Requirement 4.2.1: Use strong cryptography for the PAN over open, public networks.

No PCI DSS requirement permits storage of CVV2 after authorization. A system that keeps CVV2 fails Requirement 3.2.1.

cvv test for pci data security

What a CVV Test Covers

A CVV test searches for the 3-digit or 4-digit code in these locations:

more on this topic

  1. Production databases and data warehouses.
  2. Application logs, web server logs, and debug logs.
  3. APM and error tracking tools.
  4. Message queues and caches such as Redis and RabbitMQ.
  5. Backups, snapshots, and archives.
  6. Memory dumps and core files.
  7. Third-party processors and payment gateways under contract.

How to Run a CVV Test

  1. Map the data flow. Find every point where the authorization request enters, moves, and exits.
  2. Inventory data stores. List databases, log platforms, backups, and third parties.
  3. Run discovery. Search for a 3-digit or 4-digit field next to a PAN. Use regex patterns. Check for JSON keys such as cvv or cvc.
  4. Review code. Search source repositories for variables that hold CVV. Check debug flags.
  5. Review logs. Confirm that request bodies are not logged. Confirm that error handlers strip CVV.
  6. Test with a test card. Send a transaction from a test environment. Trace the value. Confirm it is removed after the authorization response.
  7. Check backups. Restore a backup to an isolated host. Repeat the search.
  8. Document results. Record the store, the field, the count, and the remediation date.

Failing a CVV Test

Findings that fail Requirement 3.2.1 include CVV2 in a database column, CVV2 in an application log, CVV2 in a crash report, and CVV2 in a backup that is not unrecoverable. Remediation steps: delete the data, change the code, rotate keys, and re-test. The PCI Security Standards Council states that SAD must be deleted after authorization.

Selling CVV data is not a PCI DSS activity. It is a federal crime under 18 U.S.C. 1029. Card networks and the FTC treat CVV sale as fraud.

Related PCI DSS Requirements for Test Scopes

  • Req 6.2.4: Secure coding training for developers.
  • Req 10.4.1.1: Review logs for anomalies.
  • Req 11.3.1: Internal vulnerability scans each quarter.
  • Req 11.4.1: Penetration test each year.
  • Req 12.5.2: Assign PCI DSS responsibilities.