Deleting old credit card numbers

Question

For obvious security reasons, we would like to simply erased credit cards Number in the SAP and CRM databases after one year, even if the documents that reference them were not archived (Sales Orders for example).
Does SAP have a "standard" solution for that? Wil using brute force and simply erasing the contents of the CCNUM fields in various tables work? Anybody did something like that in their system?
Ron Herrmann

Answer 1

Ron,
I am not sure if you have found any standard solution for this problem. We have faced a similar issue in a recent internal audit. What we came up was a simple solution that may not be the most elegant but works just fine without compromising the integrity of the SAP system. You can replace all the real credit cards with dummy credit card numbers. Depending on the middleware product you are using, a small routine in ABAP needs to be written, which will decrypt the original cards, replace them with dummy cards that pass the Luhn check and re-encrypt them back. This retains the integrity of the SAP system and if you were to display the Sales order, it does not cause dumps. I hope this is helpful and should you need more details, please do not hesitate to reach me anytime at [email protected]
Ryan