PCI DSS v4.0/Requirement 03: Protect Stored Account Data/44 of 250
3.5.1.2Primary account number (PAN) is secured wherever it is stored
Control family: Requirement 03: Protect Stored Account Data
Control description
Defined Approach Requirements:
If disk-level or partition-level encryption (rather than file-, column-, or field-level database encryption) is used to render PAN unreadable, it is implemented only as follows:
On removable electronic media, or If used for non-removable electronic media, PAN is also rendered unreadable via another mechanism that meets Requirement 3.5.1.
Defined Approach Testing Procedures:
3.5.1.2.a Examine encryption processes to verify that, if disk-level or partition-level encryption is used to render PAN unreadable, it is implemented only as follows:
On removable electronic media, or If used for non-removable electronic media, examine encryption processes used to verify that PAN is also rendered unreadable via another method that meets Requirement 3.5.1.
3.5.1.2.b Examine configurations and/or vendor documentation and observe encryption processes to verify the system is configured according to vendor documentation the result is that the disk or the partition is rendered unreadable.