We use essential cookies to run this site. Analytics & marketing cookies load only with your consent — see our Cookie Policy and Privacy Policy.

Talk to an expert
PCI DSS v4.0.1 · Requirement 3 of 12

Requirement 3: Protect Stored Account Data

The requirement with the sharpest teeth: sensitive authentication data must not exist after authorisation, and stored PAN must be unreadable. v4 tightened hashing — a plain hash of PAN no longer counts. Most Requirement 3 findings are data the organisation did not know it had.

Reviewed by Abhay Singh, PCI SSC-qualified QSA professional · CyberSigma is a PCI SSC-listed QSA company · Part of the Requirement 1–12 series

The controls that decide your assessment

3.2.1
Storage minimised by policy and by deletion

Account data storage is kept to the minimum required, with defined retention and a quarterly (or risk-based) process that finds and securely deletes data past retention.

3.3.1
SAD never stored after authorisation

Full track data, card verification codes and PINs/PIN blocks must not be retained after authorisation — even encrypted (3.3.1.1–3.3.1.3). Issuers have a narrow, justified exception.

3.4.1
PAN masked when displayed

Displayed PAN shows at most BIN + last four; only roles with documented need see more.

3.5.1
Stored PAN rendered unreadable

One-way keyed cryptographic hashes, truncation, tokens or strong encryption. v4.0.1 note: hashes must be KEYED (3.5.1.1) — an unsalted/unkeyed SHA-256 of PAN fails.

3.5.1.2
Disk-level encryption is not enough

Full-disk/transparent encryption alone renders PAN unreadable only on removable media; on servers it must be supplemented by another 3.5.1 method.

3.6–3.7
Key management lifecycle

Documented key-management: generation, distribution, storage (fewest custodians, split knowledge/dual control for clear-text components), rotation at cryptoperiod end, and retirement.

Control numbers reference PCI DSS v4.0.1 (June 2024). Verify wording against the standard itself — PCI SSC document library.

Where programmes actually fail

PAN hiding in logs, traces and exports

Debug logs, crash dumps, CSV exports and ticket attachments are where discovery scans find PAN. If you have not run a data-discovery scan, the assessor’s will be the first — the wrong first.

"We encrypt the disk" as the whole answer

TDE/BitLocker on a running database server does not satisfy 3.5.1 by itself (3.5.1.2). Column-level encryption, tokenisation or keyed hashing is still needed.

CVV retained "for recurring billing"

Verification codes may never be stored after authorisation — recurring billing uses credentials-on-file authorisation, not stored CVV. This one finding can end an assessment.

Key custodians without dual control

One admin who can reconstruct a clear-text key alone violates split-knowledge/dual-control expectations for manual key operations (3.7.6).

Evidence a QSA accepts

A policy document proves intent; configuration proves control. Bring these to the assessment:

  • Data-discovery scan results across servers, endpoints and file shares
  • Retention schedule and records of periodic secure deletion (3.2.1)
  • Schema/configuration showing PAN protection method per store
  • Cryptographic inventory: algorithms, key lengths, cryptoperiods, custodians
  • Key-custodian acknowledgement forms and key-ceremony records

Requirement 3 FAQ

Can we store PAN if it is encrypted?

Yes, with a documented business need — encrypted storage via one of the 3.5.1 methods plus full key management under 3.6/3.7. SAD (track, CVV, PIN) can never be stored after authorisation regardless of encryption.

Is SHA-256 hashing of PAN compliant?

Only as a keyed cryptographic hash (e.g. HMAC) with key management — v4.0.1 makes unkeyed hashes non-compliant via 3.5.1.1 (fully effective 31 March 2025).

Does tokenisation take us out of scope?

It reduces scope where the token vault and de-tokenisation are outside your environment, but the tokenisation implementation itself, and anywhere real PAN appears, remain in scope.

← Requirement 2: Secure ConfigurationsRequirement 4: Encryption in Transit →

Requirement 3 in your environment

A PCI SSC-listed QSA firm can tell you in one session whether your controls will survive assessment — before the assessment.