Cleartext Data
Also: Cleartext, Plaintext
PCIComplianceHubLast updated
Data that is not encrypted: readable as it stands, by anyone who can reach it. In PCI DSS the word marks the states the standard forbids or restricts: cleartext PAN in storage, cleartext account data over a public network, cleartext cryptographic keys outside a secure device.
Applies to. Anywhere account data or a cryptographic key exists in a form that can be read without a key.
Example. A PAN in a database column is cleartext until 3.5.1 has been applied to it. The same PAN on the wire to the processor is cleartext unless 4.2.1's strong cryptography wraps it. A data-encrypting key held in cleartext in an application's configuration file breaches 3.6.1.2, which requires keys to be encrypted with a key-encrypting key or held in a secure cryptographic device.
Limits. Cleartext is a state, not a property of a system: the same value can be cleartext in one place and encrypted a hop later. Discovery tooling exists because cleartext PAN turns up where nobody designed it to be, in logs, exports, backups and support tickets. Where cleartext key components must be handled by people, 3.7.6 requires split knowledge and dual control so no one person holds a whole key.