💼 3.5.1 PAN is rendered unreadable anywhere it is stored.

• Contextual name: 💼 3.5.1 PAN is rendered unreadable anywhere it is stored.

• ID: /frameworks/pci-dss-v4.0.1/03/05/01

• Located in: 💼 3.5 Primary account number (PAN) is secured wherever it is stored.

Description

Using any of the following approaches:

• One-way hashes based on strong cryptography of the entire PAN.
• Truncation (hashing cannot be used to replace the truncated segment of PAN).
  • If hashed and truncated versions of the same PAN, or different truncation formats of the same PAN, are present in an environment, additional controls are in place such that the different versions cannot be correlated to reconstruct the original PAN.
• Index tokens.
• Strong cryptography with associated key-management processes and procedures.

Similar

• Sections
  • /frameworks/pci-dss-v4.0/03/05/01

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 PCI DSS v4.0 → 💼 3.5.1 PAN is rendered unreadable anywhere it is stored.	3		7

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 PCI DSS v4.0 → 💼 3.5.1 PAN is rendered unreadable anywhere it is stored.	3		7

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 3.5.1.1 Hashes used to render PAN unreadable are keyed cryptographic hashes of the entire PAN, with associated key-management processes and procedures.
💼 3.5.1.2 If disk-level or partition-level encryption (rather than file-, column-, or field-level database encryption) is used to render PAN unreadable.
💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.			7