Which PCI DSS requirement is most relevant for Phreesia payments?

• A. Encrypting card data and using tokenization with strict access controls, plus regular security assessments.
• B. Storing full card numbers in local devices for quick access.
• C. Disabling encryption to speed processing.
• D. Sharing card data across departments without controls.

Answer: (A)

Protecting cardholder data is central to PCI DSS. The best answer captures the practice of encrypting card data and using tokenization so the actual numbers aren’t exposed, paired with strict access controls and regular security assessments. Encryption keeps stored data unreadable to anyone who isn’t authorized, while tokenization replaces the sensitive PAN with non-sensitive tokens the systems can use safely. Tight access controls ensure only authorized personnel can view or decrypt data, and ongoing security assessments keep defenses current against new threats. This combination directly supports safeguarding stored cardholder data and maintaining a secure payment environment, which is exactly what PCI DSS requires.

Storing full card numbers on local devices, disabling encryption to speed processing, or sharing card data across departments without controls all introduce unacceptable risk and violate PCI DSS expectations for protecting sensitive payment information.