PCI DSS Data Discovery: Finding Cardholder Data (PAN)

What is data discovery in PCI DSS?

Data discovery is the process of scanning your systems, storage, databases, files, logs and endpoints to locate where cardholder data — primarily the Primary Account Number (PAN) — is stored, processed or transmitted. In a PCI DSS assessment it is the step that proves your defined Cardholder Data Environment (CDE) is actually complete.

PCI DSS v4.0.1 makes this explicit: Requirement 12.5.2 requires you to confirm PCI DSS scope at least annually by identifying all locations of cardholder data, and Requirement 3 requires you to know, minimise and protect the account data you store. You cannot protect — or descope — data you have not found.

Why unknown cardholder data breaks PCI compliance

The most common cause of a failed or under-scoped PCI assessment is cardholder data sitting where nobody expected it: a PAN pasted into a support ticket, an unencrypted database export, a spreadsheet on a shared drive, an application debug log, an email archive or a forgotten backup. Each unknown location is in scope whether you documented it or not — and each is a breach waiting to happen.

A QSA will not simply accept your data-flow diagram. They expect evidence that you actively searched for PAN across the environment and can show the results. Data discovery is how you produce that evidence.

How PCI data discovery works (methodology)

A defensible data-discovery exercise follows a repeatable method:

• Inventory every data store, application, endpoint and third party that could receive card data.
• Run PAN-pattern scans (regex for card number formats + Luhn check) across file shares, databases, mailboxes, code repositories, log stores and endpoints.
• Validate hits to remove false positives (non-card 16-digit numbers) and confirm true PAN.
• Classify each finding: is it authorised, is it encrypted/tokenised, is it inside or outside the CDE.
• Remediate — delete, mask, tokenise, encrypt or bring into scope — and record the decision.
• Re-scan to confirm closure, and schedule the discovery to repeat at least annually (and after major change).

PCI data discovery tools: what to look for

Data discovery tools automate PAN scanning at scale. Categories range from dedicated card-data discovery scanners to broader data-loss-prevention (DLP) and data-classification platforms with PAN detectors. When selecting a data discovery tool for PCI, the capabilities that matter are:

• PAN pattern matching with Luhn validation and card-brand format coverage (to cut false positives).
• Breadth of targets — Windows/Linux file systems, databases, email, SharePoint/cloud storage, endpoints and log stores.
• Agent and agentless scanning for servers, endpoints and cloud workloads.
• Clear, exportable evidence and reporting you can hand to a QSA.
• Safe handling — the tool must not itself become an unencrypted store of the PAN it finds.

Tooling matters, but a tool alone is not compliance. The value is in scoping the scan correctly, validating results and driving remediation — which is where an experienced assessor pays for itself.

Data discovery and PCI scope reduction

Done well, data discovery does more than prove scope — it shrinks it. Every location where you can eliminate, tokenise or truncate PAN removes systems from the CDE, which cuts assessment effort, cost and risk. Pairing discovery with tokenisation and network segmentation is the single most effective way to reduce what you must protect and validate.

Frequently asked questions