Sensitive Authentication Data (SAD)

Overview

Sensitive Authentication Data (SAD) is cardholder authentication data whose compromise could enable payment fraud, including full track data, card verification codes or values, and PIN or encrypted PIN blocks as defined by payment-card standards. SAD is distinct from general cardholder data because storage after authorization is heavily restricted even when the data is encrypted. It should be interpreted alongside Data Loss Prevention (DLP), which may affect the same workflow without representing the same control, event, or risk.

Unnecessary collection, logging, debugging, caching, backups, or third-party transmission can create severe fraud, compliance, and breach exposure.

Organizations should minimize collection, prevent post-authorization storage, tokenize where appropriate, mask interfaces, restrict access, scan logs and backups, and validate processor integrations.

Retain data-flow diagrams, storage discovery results, deletion evidence, access reviews, processor responsibilities, test records, incident findings, and approved exceptions.

For Sensitive Authentication Data (SAD), the trust decision should establish Sensitive Authentication Data (SAD) is cardholder authentication data whose compromise could enable payment fraud, including full track data, card verification codes or values, and PIN or encrypted PIN blocks as and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for identity proof and credential state, rather than checking only a successful request. Logs concerning the Sensitive Authentication Data context and identity proof and credential state should support investigation without exposing reusable secrets or unnecessary personal data.

Review of Sensitive Authentication Data (SAD) should compare permitted and rejected actions related to identity proof and credential state, confirm that recovery cannot bypass the primary safeguard, and remove obsolete access promptly.