BrowseToolsGuidesComparePricingStacksPlaybooksBlogSearch
ComplianceReadiness checkISO 27001ISO 42001SOC 2PCI DSSPolicy templatesControl mapCompliance softwareFramework compare
Protect account data

Requirement 3: Protect stored account data

If you store account data, it must be rendered unreadable, and sensitive authentication data must never be stored after authorisation.

SCOPEEVIDENCERISKEVIDENCETESTEVIDENCEREPORTEVIDENCEAUDIT TRAILPCI Req 3 EvidencePOLICY / CONTROL / EVIDENCE / REVIEW

Sub-requirements

3.1

Processes and mechanisms are defined and understood

2 defined requirements

Document data-retention and protection policy.

View defined requirements →
3.2

Storage of account data is kept to a minimum

1 defined requirement

Define retention, store only what is needed, and securely delete the rest.

View defined requirements →
3.3

Sensitive authentication data (SAD) is not stored after authorisation

6 defined requirements

Never store full track data, card verification codes, or PINs after authorisation.

View defined requirements →
3.4

Access to displays of full PAN and ability to copy PAN is restricted

2 defined requirements

Mask PAN on display (show at most first six/last four) except for those with a need.

View defined requirements →
3.5

PAN is secured wherever it is stored

4 defined requirements

Render PAN unreadable via strong encryption, truncation, tokenisation, or hashing.

View defined requirements →
3.6

Cryptographic keys protecting stored account data are secured

5 defined requirements

Protect keys, restrict access, and store them separately from the data.

View defined requirements →
3.7

Key management is fully documented and implemented

9 defined requirements

Define key generation, distribution, rotation, retirement and replacement procedures.

View defined requirements →

Tips

  • ›The cheapest way to comply is to not store cardholder data at all, use a tokenising provider.
  • ›Run a discovery scan to find PAN that has leaked into logs, backups, or spreadsheets.

Evidence to keep

  • ✓Data-retention policy
  • ✓Encryption/tokenisation design
  • ✓Key-management procedures
  • ✓PAN discovery scan results

Example

A merchant tokenises cards at the gateway, stores only tokens and last-four, masks PAN on all screens, and never logs full PANs.

Policy templates for this control

Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.

Cryptography and key management policyUse for ISO 27001 A.8.24, secure authentication, encryption, SOC 2 Security, and PCI DSS encryption requirements.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Email and communications security policyUse for ISO 27001 A.5.14 and A.8.24, information transfer, encryption in transit, phishing response, and SOC 2 communication controls.Data retention and disposal policyUse for ISO 27001 A.5.33, A.5.34, A.8.10, SOC 2 Confidentiality and Privacy, and PCI DSS requirement 3.
Open the control-to-policy map
← Req 2Req 4 →