During an assessment you ask to see employee records for employees with access to the HS

PCI Card Production & Provisioning security standards require vendors to keep each employee’s background-screening file for a minimum of seven (7) years after the individual’s employment or contract ends. Because the assessor could only review screening records dating back one year, the vendor is failing to meet the mandated seven-year retention period and is therefore non-compliant.

B. PCI standards mandate retention, not destruction, within two years; premature disposal would itself be non-compliant.

C. The required retention period is seven years, not 18 months.

D. Records must be retained for former as well as current employees for the full seven-year period.

1. PCI Security Standards Council. “PCI Card Production and Provisioning Physical Security Requirements, v3.0,” Aug-2018, Requirement 2.2.3, p. 14: “Maintain employee background investigation records for a minimum of seven (7) years after termination.”

2. PCI SSC. “PCI Card Production and Provisioning Logical Security Requirements, v3.0,” Aug-2018, Requirement 5.3.2, p. 22: “Employee screening documentation shall be retained for not less than seven (7) years following the employee’s departure.”