3.5 PAN is secured wherever it is stored
How to meet it
Render PAN unreadable via strong encryption, truncation, tokenisation, or hashing.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 3.5, in plain English.
3.5.1Wherever PAN is stored it is made unreadable using strong one-way hashes, truncation, index tokens, or strong cryptography with proper key management.
3.5.1.1Hashes used to render PAN unreadable are keyed cryptographic hashes of the entire PAN with proper key management.
3.5.1.2Disk- or partition-level encryption to render PAN unreadable is only allowed on removable media, or PAN must also be unreadable by another method.
3.5.1.3Where disk encryption is used, logical access is managed separately from OS authentication and decryption keys are not tied to user accounts.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Cryptography and key management policyUse for ISO 27001 A.8.24, secure authentication, encryption, SOC 2 Security, and PCI DSS encryption requirements.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Password and authentication policyUse for ISO 27001 A.5.17, A.8.5, SOC 2 Security, and PCI DSS requirement 8 authentication controls.Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.
Open the control-to-policy map← 3.4 Access to displays of full PAN and ability to copy PAN is restricted3.6 Cryptographic keys protecting stored account data are secured →
Back to Requirement 3, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.