PCI SSF 1.1: Secure Software Standard 1.1 (Critical Asset Identification)

An inventory kept by the vendor lists all sensitive data the software stores, processes or transmits: payment data, authentication credentials, cryptographic keys together with related material such as IVs and seeds for random number generators, and configuration data relevant to security. The inventory records where each item is held in transient, semi-permanent and non-volatile storage and which controls protect it, and the assessor checks it against the software's transaction types, cryptographic implementations, accounts and configuration options.