title: SQL Server 2008 + PCI Compliance? Pertains to PCI, as well as Symmetric keys!
body: <p>I've never had to deal with PCI compliance before.  I've been reading their documentation and it says I need to protect the credit card number, expiration date and the card holder's name.  No storage of security codes ever.</p>
  
  <p>In their documentation, it just says protect.  Is this saying I need to encrypt these 3 columns in my database?  I thought only the number was the data that needed to be encrypted.  Either way, I'm fine with.</p>
  
  <p>If I need to encrypt all three columns, do I share one certificate and have 3 symmetric keys, or will I only need 1 of each, with that symmetric key being used on all 3 columns?  The reason I ask is in the BoL documentation on encrypting a column, the key is named specifically after the column they are encrypting.</p>
  
  <p>Thanks for all the help!</p>