Identify whether the assessed entity is an issuer or supports issuing services.
If the assessed entity is an issuer or supports issuing services:
i. Identify and describe the business justification for storing sensitive authentication data.
ii. Identify the responsible personnel interviewed who confirm the business justification.
iii. Describe how the data was observed to be secured.