Forum Discussion
Inbound Screening & PCI-DSS
PCI-DSS frowns on having credit card numbers and related information in systems not otherwise in scope. Yet we sometimes have law enforcement asking for us for researching by these very terms; they send these sometimes via E-mail. I wonder therefore whether Exchange can screen using DLP policies, with the intent of adding controls, such as masking or adding "no forwarding, no printing," and so on. Possible? Advisable?
1 Reply
Yes, Microsoft Exchange supports implementing Data Loss Prevention (DLP) policies that can detect credit card numbers and other sensitive PCI-DSS data in email messages. These DLP policies can automatically apply controls such as blocking the email, encrypting it, informing recipients, or restricting actions like forwarding and printing, helping reduce risks related to sensitive data exposure.
However, native Exchange and Microsoft 365 DLP solutions do not natively "mask" or redact credit card numbers inside email content automatically; true masking usually requires third-party or advanced solutions such as Azure Information Protection (AIP) with sensitivity labels or specialized DLP products.
From a PCI-DSS perspective:
- PCI DSS requires that cardholder data is protected and that sensitive data should not be stored or transmitted in scopes or systems not fully secured or compliant.
- Emailing credit card information in unprotected form is not compliant, so if law enforcement sends cardholder data via email, DLP can help by enforcing encryption, preventing forwarding, or blocking messages containing that data.
- Ideally, strong encryption and restricted access controls should be applied both in transit and at rest.
In summary:
- Exchange DLP can detect and enforce policies on PCI card data in email, restricting actions like forwarding and printing.
- Full sensitive data masking requires additional tools beyond native Exchange DLP.
- Using DLP to block or encrypt PCI data in emails helps with compliance and reduces risk but should be combined with clear policies on transmission and storage.
- It's advisable to implement these DLP controls combined with organizational training and secure alternative methods for handling cardholder data requests such as law enforcement.
This approach aligns with PCI DSS goals by limiting exposure of PCI data in email systems, adding a layer of control while maintaining communication needs with careful risk management.
