← PCI DSS 4.0.1 · Req 3 — Protect stored account data

3.5 — PAN is rendered unreadable wherever it is stored

critical encryption-at-restkey-management

Requirement

PAN is rendered unreadable anywhere it is stored using one-way hashes of the entire PAN, truncation, index tokens, or strong cryptography with associated key management. Disk-level encryption alone is only acceptable for removable media.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

cardholder datacard datapayment cardcard numberspanprimary account numberaccount datacdecardholder data environmentpayment data

Required element 2 — any one of

encrypttokeni…tokentokenshashhashedtruncat…unreadablestrong cryptography

Supporting terms — specificity signals

3.5.13.5.1.2aes-256keyed hashvaulttokenisation providertokenization providerwe never store pando not store pan

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

pan is stored in plaintext card numbers are stored in plain text unencrypted card numbers stored in clear text card numbers in plain text card numbers in plaintext pan in plain text pan in plaintext card numbers in clear text

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
HIPAA	164.312(a)(2)(iv)	Encryption and decryption at rest (A)	encryption-at-rest key-management
NIST CSF 2.0	PR.DS-01	Confidentiality, integrity and availability of data at rest	encryption-at-rest key-management
ISO 27001	A.8.24	Use of cryptography	encryption-at-rest key-management
CCPA/CPRA	1798.100(e) & 1798.150	Reasonable security procedures	encryption-at-rest
ISO 27001	A.7.10	Storage media	encryption-at-rest
ISO 27001	A.8.1	User end point devices	encryption-at-rest
GLBA	314.4(c)(3)	Encryption of customer information in transit and at rest	encryption-at-rest
GDPR	Art.5(1)(f)	Integrity and confidentiality	encryption-at-rest