An Overview of PCI DSS Backup Requirements

Backups can protect your business from data loss, but they can also increase certain risks. The ongoing need to back up data creates additional exposure for cardholder data. PCI DSS requires systems that protect cardholder data to be secure. Organizations that process, store, or transmit cardholder data must also secure their backup environments to comply with PCI DSS.

Ensuring integrity and compliance with PCI DSS requirements requires a combination of different types of controls, including encryption, access management, physical security, and audit logging for stored account data.  Under PCI DSS 4.0.1, organizations must ensure that backup copies containing cardholder data remain secure throughout their lifecycle, both at rest and in transit.

PCI DSS requires that backup copies be protected against unauthorized removal or modification. Understanding these controls helps the organization reduce unnecessary data exposure and ensure secure data recovery. For more information, refer to the PCI DSS 4.0.1 requirements.

PCI DSS Access Control Requirements That Apply to Backup Systems

PCI DSS does not establish a dedicated requirement for backups. However, several requirements may apply depending on the data stored, the backup environment, and how administrators control and manage backup copies.

The following requirements are especially important for keeping backups secure.

1. Protecting Stored Account Data (Requirement 3)

Requirement 3 focuses on protecting stored account data, including Primary Account Numbers (PAN). PAN protection controls apply wherever PAN is stored, whether in databases, files, backup media, archival storage, or other locations.

Some key controls include:

• Requirement 3.2.1: Organizations retain account data only as required for legal, regulatory, business, or other needs, with documented retention periods. Account data no longer needed by the organization must be securely deleted or made unrecoverable. Additionally, organizations must verify at least once every three months that the data has been securely deleted.

• Requirement 3.3.1: Sensitive Authentication Data (SAD) must not be stored, regardless of whether it is encrypted or not.

• Requirement 3.5.1: PAN must be stored in a manner that it is rendered unreadable to unauthorized systems. The methods for achieving this include hashing, tokenization, strong cryptography, and truncation.

In backup environments, it should not be assumed that data storage protection controls are inapplicable to backups. For instance, if a payment application stores PAN and processes other payment transactions, and daily backups are created, those backups should also protect PAN and any other sensitive authentication data.

When encryption is implemented or used, appropriate cryptographic key management must be considered in accordance with Requirements 3.6 and 3.7. Encryption keys must be protected, and their lifecycle management-including key generation, distribution, storage, rotation, and destruction-must be addressed.

Requirements 7 and 8: Access and Authentication

The backup system often holds a large amount of sensitive data and information. Even if the backup data is encrypted, unauthorized access to backup consoles and storage can create security risks.

The PCI DSS requirements 7 and 8 cover the restrictions on access and user authentication.

Requirement 7: Restrict Access Based on Business Need to Know

Access to backup systems should be limited to the minimum necessary for employees to fulfill their job responsibilities. Only authorized personnel should be permitted to view, modify, or delete backup data.

To meet this requirement, it is recommended that organizations do the following:

• Limit access to backup data based on documented job responsibilities.
• Restrict administrative access to a minimum.
• Periodically review access control lists and remove access when it is no longer required.
• Where practicable, separate the administrative responsibilities for data backups from routine operational duties.
• Remove access when a user no longer requires it, e.g., upon job change or termination.

Requirement 8: Identify Users and Authenticate Access

PCI DSS requirement 8 addresses user access to system components and individual user accounts.

To meet this requirement in the backup environment, organizations are recommended to do the following:

• Assign unique user IDs to administrators and authorized users
• Limit use of shared user IDs to exceptional cases, and only if adequate security controls are implemented
• Use strong authentication methods
• Implement multi-factor authentication to meet other PCI DSS requirements
• Monitor the use of privileged user accounts

When multiple users share an account, it may be difficult to determine who performed specific actions. For example, when several IT administrators use a single account to restore payment databases, individual accounts and action logs promote accountability and facilitate investigations.

Requirements 9 and 10: Physical Security and Logging

Due to the importance of physical security, it is essential to protect backup data and backup media within the scope of the controls. 

Requirement 9: Restrict Physical Access to Cardholder Data

Requirement 9.4 addresses the secure storage, access, distribution, and destruction of media containing cardholder data.

Various controls include:

• 9.4.1. Physically secure all media containing cardholder data.
• 9.4.1.1. Store off-line media backups containing cardholder data in a secure location.
• 9.4.1.2. Review off-line backup storage location security at least once every 12 months.
• 9.4.3 and 9.4.4. Secure media that is transported outside the facility and obtain management approval for transport.
• 9.4.5. Maintain a log of electronic media containing cardholder data.
• 9.4.7. Destroy or make the electronic media cardholder data unrecoverable when no longer required for business or legal reasons.

Requirement 10: Log and Monitor All Access to System Components and Cardholder Data

Backup environments should support the logging and monitoring of system components and cardholder data.

PCI DSS requirement 10. Log and monitor all access to the cardholder data or system components. 

Some examples of applicable events:

1. Successful and unsuccessful administrative logins
2. Changes to backup configurations and permissions
3. Backup deletion or modification
4. Restoration activities
5. Access to systems containing cardholder data

Requirement 10.5.1 requires audit logs to be retained for 12 months, with the most recent three months readily accessible. However, this does not mean backup copies must be retained for 12 months; their retention period must be determined separately in accordance with Requirement 3.2.1.

Understanding the Scope and Contents of Backed-Up Data

Before securing backups, it's important to understand what they contain and where they’re stored.The backup may be larger than the primary payments database. It may include application files, server images, transaction logs, configuration files, system logs, archived databases, and exported reports.

To secure backups, organizations must understand the contents of those backups.

Data backups may include:

• Application files
• Server images
• Transaction data
• Configuration and system logs
• Database and system archive files
• Report export files

Backups may also contain sensitive data such as:

 

Backup inventories containing account data should be identified and assessed as part of the PCI DSS scope.

Designing Secure Backup Storage and Access Paths

To protect the integrity of backups and provide assurance that data can be restored, unauthorised access must be restricted. When determining how to accomplish this, organisations should also consider backup storage locations, transport methods and systems that have access to the backups.

A secure backup design will include all of the following:

• Backup repositories that are physically separated and have controlled access.
• Backup infrastructure and production environmentally segregated networks.
• Secure backup transmission.
• Protections against unauthorized modification and deletion.
• Audit trails for backup administration.

Wherever possible, organizations should consider employing immutable backups and/or offline backups. This helps to decrease the likelihood that ransomware encrypts both the production and the recovery copies of the data.

A well-designed backup environment will also help to reduce unnecessary exposure of cardholder data in development, test, and DR environments.

Encryption of Backup Copies and Cryptographic Key Management

Backup copies may contain cardholder data. In such cases, a critical element of security is the encryption of the backups. PCI DSS 3.5.1 states that wherever cardholder data is stored, it must be rendered unreadable.
Therefore, it is vital to encrypt backup copies of data and to utilize protected transmission methods for transfer of the backups.Encryption of the data does not resolve all of the requirements related to the protection and management of cryptographic keys. PCI DSS 3.6 and 3.7 address the management of cryptographic keys.

Some key management principles include:

• Restricting access to cryptographic keys.
• Storing keys separately from the data.
• Defining when keys will be replaced and/or rotated.
• Keeping keys safe from unauthorized alteration.
• Implementing a key-management process and maintaining responsible party documentation.
• Securely retiring keys, as appropriate.

Storing the encryption keys and encrypted data together in an unrestricted location will lessen the overall protection of encryption.

Retention Policies for Backup Versions and Replicas

In order to allow for business continuity while adhering to the regulations, organizations should have documented policies pertaining to the retention of backup versions and replicas.

PCI DSS Requirement 3.2.1 limits the retention of account data to legal, regulatory, and business requirements. It does not set a single backup retention period for all entities.

An effective retention policy should identify:

• The length of time each backup category is retained
• The reason for retention (e.g., business or legal requirement)
• Where the backups contain cardholder data
• The procedures for secure deletion of expired backups and replicas
  
  

How is the deletion of data confirmed across all storage locations?

For example, a retention policy could keep daily backups for operational recovery and monthly backups to meet business requirements. Retention periods should be determined by risk and business impact analysis, not by PCI DSS.

Consider replicated or snapshot copies and cloud archives when developing a retention policy. Deleting the original database does not remove cardholder data from every backup and replica.

Restore tests and Backup Recovery

Backups are useless if the data cannot be restored. To ensure backup data is secure, test the recovery procedure to confirm that the data is complete, accessible, and usable.

Recovery testing should help answer the following questions:

• Were all the required backup files restored?
• Is the data restored to an appropriate state?
• Do access controls remain in effect?
• Are systems restored to an appropriate secure state?
• Do encryption keys remain in the control of authorized personnel?

 

This test helps meet the recovery time objectives (RTOs) and recovery point objectives (RPOs) during normal business operations. Accordingly, the results should always be documented, failures identified, and corrective actions tracked.

Backup Access Controls: Viewing, Copying, Deleting, and Restoring Data

Access management for backups should encompass the entire lifecycle of backups. Permissions should be defined for various backup activities, and such access should be restricted to authorized personnel only.

Viewing Backup Data

Access to backup data should be restricted based on business responsibilities. For instance, administrators, who may manage payment records, should not be granted access to payment records because they manage the backup infrastructure.

Copying and Exporting Backup Data

Backups should be protected from unauthorized copying, and organizational controls should be implemented to restrict and protect exported backup data.

Deleting Backup Data

Delete backup data only when explicitly required, and retain documentation of the deletion.

Restoring Backup Data

Restoring backups may reintroduce deleted data. Before returning restored systems to production, verify their security, configuration and access controls, required encryption, and compliance with retention policies.

Cloud Backup Providers and PCI DSS Compliance

Cloud backup services may provide the ability to scale and support geographic redundancy. However, using a cloud provider does not automatically ensure an organisation’s backup environment is PCI DSS compliant. It is the organization’s responsibility to implement and retain controls to ensure the integrity of the backup data.

It is also essential to evaluate:

• Confirm the payment card data service provider’s PCI DSS compliance status for the service provided.
• Review the provider’s Attestation of Compliance (AOC) and service scope.
• Identify responsibilities for encryption key management and access control.
• Determine the location of cardholder data.
• Establish procedures for incident reporting.
• Understand the responsibilities for log retention and maintenance of appropriate agreements.

For enterprises using external payment platforms, it is essential to understand how payment data moves between merchants, gateways, processors and cloud environments.

PCI DSS requirements for Payment Gateways describe the security and compliance obligations for the payment processing relationships.

Physical Security Controls for Backup Media

Physical backup media, such as removable drives and magnetic tapes, are considered storage media and are deemed to expose cardholder data if lost or stolen.

PCI DSS requirement 9.4.1, Protect cardholder data, requires measures to safeguard media containing cardholder data. Requirement 9.4.1.1 specifically requires offline backup media to be protected.

In order to meet PCI DSS requirements, organizations should:

• Store backup media in a secure location
• Maintain an inventory of media and records of movement
• Use secure shipping methods
• Assess the security of offline storage locations
• Securely destroy media or make stored data unrecoverable when no longer needed

Common PCI DSS Backup Compliance Failures

Even organizations with established backup processes can overlook basic security measures. Common issues include:

1. Unprotected Backup Copies: Backup files containing PAN are created without protection and stored in a way that could expose sensitive information if breached.
2. Retention of backups: Organisations do not maintain a business justification for retaining old backup files or a documented process for securely deleting expired data.
3. Unrestricted administrative access: An excessive number of individuals can view, copy, delete, or recover sensitive backup files.
4. Audit logs absent: Backup activities are neither documented nor monitored, making it impossible to determine who modified them or when.
5. Incomplete account data inventory: Cloud snapshots, archived exports, and copies stored in the disaster recovery environment are excluded from the account data inventory.
6. Untested restoration procedures: Companies assume backup data is usable without testing documented restoration procedures.
7. Uncertain cloud duties: Organizations rely on providers’ representations regarding the scope of their solutions, the allocation of shared responsibilities, and the areas over which the organization retains control.

Tackling such issues demands a well-managed plan for risk assessment, implementation of security controls, documentation, and continuous compliance monitoring. INTERCERT's GRC services aid organizations in their assessment of governance, risk, and compliance requirements as well as the assessment of pertinent security controls.

Protect Your Payment Data with a Stronger Compliance Approach

Backups are essential for business continuity, but they can also expose cardholder data. Organizations must apply safeguards- including access controls, retention management, and secure physical protection-to all backup environments consistently.

INTERCERT, a PCI Qualified Security Assessor, helps evaluate security controls and determine compliance with standards and regulatory requirements. As a payment facilitator, payment processor, financial technology company, or a SaaS/Internet provider, being a PCI DSS-compliant service provider enables you to maintain a secure payment environment.

Do you need help in determining your PCI DSS security and compliance controls? Contact INTERCERT to learn more about our PCI DSS compliance and assessments.