## 13.13.1.2.5  Payment Card Security According to PCI-DSS
##  Note
The Payment Card Industry Data Security Standard (PCI-DSS) was jointly developed by major credit card companies in order to create a set of common industry security requirements for the protection of cardholder data. Compliance with this standard is relevant for companies processing credit card data. For more information, see the official website of the PCI Security Standards Council at https:/ / www.pcisecuritystandards.org .
This section of the security guide supports you in implementing payment card security aspects and outlines steps that need to be considered to be compliant with the PCI-DSS.
Please note that the PCI-DSS covers more than the following steps and considerations. Complying with the PCI-DSS lies completely within the customer's responsibility, and we cannot guarantee the customer's compliance with the PCI-DSS.
For current information about PCI-DSS, see also SAP Note 1609917 .
PCI-relevant POS (Point-of-Sale) sales can be processed in SAP S/4HANA Retail for merchandise management for financial postings and inventory management. Depending on the configuration of the POS solution, the data transferred to SAP S/4HANA Retail for merchandise management can contain credit card information that needs to be handled according to the PCI Standard. In this case, the card data has to be encrypted during inbound processing. The relevant asynchronous communication methods are the IDocs with the message type WPUBON (Upload Sales Documents per Receipt), and message type WPUTAB (Upload End-of-Day Closing POS).
For more information about Archiving , RFC Debugging , Forward Error Handling (FEH) and Card Verification Values (CVV) , see Payment Card Security According to PCI-DSS [page 125].
## Interfaces (IDoc/Services)
##  Note
Note that IDoc segments cannot store credit card numbers in clear text due to the PCI security standard compliance. Once an IDoc is being processed within the IDoc Framework, all values are temporarily stored, including the clear text credit card number.
For more information about how to process customer-specific IDocs containing credit card information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Handling Sensitive Data in IDocs into the search bar, press Enter , and open the search result with that title.
## Encryption/Decryption and Storage of the Encrypted Number
IDoc Encryption/Encryption process: IDoc data records are sent to the BAdI implementation IDOC\_PCI\_ENCR\_IM that is used for the PCI DSS inbound IDoc encryption. The process of encrypting the credit card number starts by identifying the segment with credit card information in the IDoc record structure. The data from the relevant segments E1WPZ02 and E1WPB06 is mapped to the internal record structure in order to retrieve the card GUID, the name of the credit card institution number, and the credit card number. After this, the security level of the credit card institution is verified in Customizing:
- If the security level is set to 2, the credit card number is encrypted.
- If the security level is set to 1, the credit card number is masked.
The card GUID and the encryption type are mapped to the structure for decryption and a message is displayed that informs the user whether the encryption was successful. After this, the final check for consistency is performed.
Decryption process: The process of decrypting the credit card number starts by identifying the segment in the IDoc record structure that contains the credit card information. The data from the relevant segments E1WPZ02 and E1WPB06 is mapped to the internal record structure in order to retrieve the card GUID, the type of encryption, and the credit card number. The encryption type is set to the fixed value 2. The credit card number is decrypted and a message is displayed that informs the user whether the encryption was successful.
- The BAdI implementation name for PCI DSS inbound IDoc decryption is IDOC\_PCI\_DECRYPTION\_IM .
- One of the IDoc database encryption/decryption ( IDOC\_DATA\_MAPPER, IDOC\_DATA\_CRYPTION )is called before saving to the IDoc database and the other after reading from it.
## Customizing
Maintain the following settings in Customizing:
- The basic settings for payment cards: In Customizing for SAP Customizing Implementation Guide under Cross-Application Components Payment Cards Basic Settings Assign Checking Rule .
- The settings for the encryption save mode: Define whether existing GUIDs for credit cards are reused. The default setting is set to reuse the existing GUID. You can adapt the default with a customer-specific BAdI implementation, using the enhancement spot ES\_WPOS\_PCA\_SECURITY and the BAdI definition WPOS\_PCA\_SECURITY .
- The security settings for the credit card institute: In Customizing for SAP Customizing Implementation Guide under Cross-Application Components Payment Cards Basic Settings Make Security Settings for Payment Cards . For an example for security settings for payment cards, refer to the following entries:
- Security Level: Masked Display and Encrypted When Saved
- Access Log: Logging of unmasked display
- Visible Characters for Masking: At start : 4 At end : 4
- The settings for masking the credit card number: In the customizing table of the transaction WECRYPTDISPLAY , maintain the settings for the Assignment of Encrypted Segment field as follows:
- Message Type : WPUBON
- Segment Type : E1WPB06
- Field Name : KARTENNR
## and
- Message Type : WPUTAB
- Segment Type : E1WPZ02
- Field Name : KARTENNR