Cardholder data outside the CDE: the question SAQs don't ask

A self-assessment questionnaire scopes your payment environment. It doesn't ask whether primary account numbers have leaked into spreadsheets, support notes and email on staff laptops.

PCI DSS scope is defined by where account data is stored, processed or transmitted. A self-assessment questionnaire asks you to describe that environment and attest to the controls over it. What it does not ask, in any of its forms, is whether primary account numbers exist somewhere you did not describe.

That distinction matters because scope follows the data, not the diagram. A PAN sitting in a support ticket export on a laptop puts that laptop in scope whether or not it appears on your network diagram or in your last attestation.

How PANs get out of the cardholder data environment

• Customers emailing card details or typing them into a web form, landing in a shared support mailbox
• Agents pasting a PAN into a ticket to reproduce a problem
• Finance reconciliation exports that carry full PANs out of a gateway report
• Chargeback and dispute evidence packs assembled in a shared folder
• Screenshots taken during troubleshooting
• Call recordings and their transcripts, where the caller reads the number aloud
• Production data copied into a development or test environment

None of these are malicious and most are one-off decisions made under time pressure. They persist because nothing goes looking for them afterwards.

What Requirement 3 says about it

Requirement 3 governs the protection of stored account data. Sensitive authentication data - full track data, card verification codes, and PINs - must not be retained after authorisation, even if encrypted. PANs may be stored where rendered unreadable, and storage must be limited to what is necessary for legal, regulatory or business need, with a defined retention period and a documented process for deleting data that exceeds it.

Read that last part against a spreadsheet in a finance folder from two years ago. There is no retention period on it, no deletion process behind it, and probably no record that it exists.

Why an annual questionnaire misses it

Every answer can be truthful about the environment you scoped. The exposure lives in the distance between the environment you scoped and the estate you actually run.

A discovery pass that answers the question

1. 1Search the whole estate rather than the CDE: endpoints, file shares, and mailboxes. Searching only inside your scope cannot tell you whether your scope is right.
2. 2Match PAN patterns with validation. A Luhn check plus issuer-prefix matching removes most of the false positives that make raw pattern searches unusable.
3. 3Look for sensitive authentication data separately. A CVV stored alongside a PAN is a Requirement 3.3.1 problem, not a scoping question, and it needs a different response.
4. 4Triage by location. A single PAN in one agent's downloads folder is a different remediation from a recurring export that lands every month.
5. 5Remove what should not be there, or bring the location into scope deliberately and control it.
6. 6Repeat. Annual is the attestation cadence. Quarterly or continuous is the cadence that keeps the answer true between attestations.

The overlap with GDPR

A card number belongs to a person, so a file containing PANs is usually in scope for both PCI DSS and data protection law. One discovery pass answers both questions where it classifies what it finds by framework. Running two separate exercises, one for the QSA and one for the DPO, is the most common source of duplicated effort in a lean team.