This subject came up before.
Subsequenty, I recieved another merchant mailing from Discover. It was confimed that they expressly prohibit this code being stored.
Section 12.7 of
http://www.discovernetwork.com/common/image/operat_reg.pdf States the following:
You must not retain any CID data for any Card transaction or any Cardmember, in your records or otherwise, for any reason, including recurring billing transactions described in Section 5.3. Furthermore, the CID must not be recorded on Sales Data or any other evidence of the Card transaction.
This Does bring up another requirement.
Section 12.6 states:
Card Account numbers and Card transaction data that you store must be stored in a secure environment that is protected by information security technologies such as encryption, firewalls and access controls.
This tells me that storing the credit card information in plain text form in the customer record is prohibited.
One solution to this is for ISTech to incorporate RSA Encryption on just this field. This would also provide another level of access control to the CC information in addition to masking the plain text CC information from Database Maintenance and ODBC access.