PCI DSS v4.0/Requirement 03: Protect Stored Account Data/43 of 250
3.5.1.1Primary account number (PAN) is secured wherever it is stored
Control family: Requirement 03: Protect Stored Account Data
Control description
Defined Approach Requirements:
Hashes used to render PAN unreadable (per the first bullet of Requirement 3.5.1) are keyed cryptographic hashes of the entire PAN, with associated key-management processes and procedures in accordance with Requirements 3.6 and 3.7.
Defined Approach Testing Procedures:
3.5.1.1.a Examine documentation about the hashing method used to render PAN unreadable, including the vendor, type of system/process, and the encryption algorithms (as applicable) to verify that the hashing method results in keyed cryptographic hashes of the entire PAN, with associated key management processes and procedures.
3.5.1.1.b Examine documentation about the key management procedures and processes associated with the keyed cryptographic hashes to verify keys are managed in accordance with Requirements 3.6 and 3.7.
3.5.1.1.c Examine data repositories to verify the PAN is rendered unreadable.
3.5.1.1.d Examine audit logs, including payment application logs, to verify the PAN is rendered unreadable.