## 12.2.5  Making Settings for Payment Card Security
You make settings for payment card security in Customizing for Cross-Application Components under Payment Cards Basic Settings Make Security Settings for Payment Cards .
The following explanations refer to the settings there.
## Security Level
You can select from the following options:
- No Additional Security Measures
- Masked Display, Not Encrypted When Saved
- Masked Display and Encrypted When Saved
Masked display means that when you display or change objects that contain a payment card number, the system hides part of the number.
<!-- image -->
##  Example
For payment card number 1111222233334444, the system displays a value of 1111********4444.
You can specify the number of visible characters at the beginning and end of the payment card number. The security standards of the payment card industry demand that a maximum of six characters are visible at the beginning, and four at the end.
This masked display is applied for all types of payment cards. If you also select encrypted saving, then the system applies this only to those payment card types that you specified explicitly in Customizing (see the section "Relevant Payment Card Types").
We recommend that you use the security level Masked Display, and Encrypted When Saved . Y ou should specify the smallest number of visible characters possible that allows the payment cards to be identified (for example, using the last four characters).
## Unmasked Display
If card numbers are displayed in masked format, it is still sometimes necessary to display the number unmasked. In various transactions, we therefore provide a function for unmasked display of payment card numbers. You can make two specifications for this function in Customizing:
- Access log
- Additional authorization check
You can have the system record each display of an unmasked payment card in an access log. This enables you to monitor which users have displayed which payment card numbers and when.
You can use an additional authorization check for authorization object B\_CCSEC to restrict the use of the display of unmasked card numbers.
We recommend that you activate this additional authorization check and assign the appropriate authorization only to those user groups that need to access unmasked card numbers as part of their daily work. You should also activate the access log.
## Analyzing Access Logs
You can run reports on accessing of payment card data. For more information, see Security-Relevant Logs and Tracing [page 49].
## Key Replacement
By setting the Key Replacement Active indicator, you specify that the system supports periodic replacement of the keys (PSEs) used for encryption.
##  Caution
This indicator is visible only if you installed S/4HANA 6.0 with Enhancement Package 4 and activated the business function Periodic Key Replacement for Payment Card Encryption (PCA\_XKEYV).
We recommend that you set this indicator.
## Relevant Payment Card Types
You can choose the card types (such as, AMEX, Mastercard, VISA) for which you want to activate encryption. The collumn for this is not visible in the settings for the payment card unless you have already made settings for payment card encryption in the business partner. This means that you have to have already executed the migration program or to have set up encrypted saving of further data records. You can make these settings in Customizing for Cross-Application Components under Payment Cards Basic Settings Maintain Payment Card Type .