PCI DSS Requirement 3: Protecting Stored Account Data

Requirement 3 Structure

Deep Dives

• 3.2.1 - Retention and disposal policies covering all storage locations; limit retention to legal/business need; secure deletion; verify at least every three months that expired data is gone. Coverage of SAD stored prior to authorization completion became mandatory on 31 March 2025.
• 3.3.1 - SAD not retained after authorization, even if encrypted; render unrecoverable when auth completes. Includes 3.3.1.1 full track, 3.3.1.2 card verification code, 3.3.1.3 PIN and PIN block.
• 3.3.2 - If SAD is stored electronically before authorization completes, encrypt with strong cryptography (mandatory since 31 March 2025).
• 3.4.1 - Mask displayed PAN (BIN + last four maximum for most roles).
• 3.4.2 - Remote-access technologies block copy/relocation of PAN except documented authorized roles.
• 3.5.1 - Render PAN unreadable wherever stored via keyed strong hashes of the entire PAN, truncation (with correlation controls if hashed+truncated coexist), index tokens, or strong cryptography with key management.
• 3.5.1.1 - Hashes used for 3.5.1 must be keyed cryptographic hashes of the entire PAN with key management per 3.6/3.7 (mandatory since 31 March 2025).
• 3.5.1.2 - Disk/partition encryption alone is only appropriate as the sole PAN control on removable media; non-removable media needs another 3.5.1 mechanism as well.
• 3.6 / 3.7 - Protect secret/private keys used for stored account data; store keys in the fewest possible locations (3.6.1.4); manage full key lifecycle (generation through retirement).

How CyberSilo Helps

• Compliance Standards Automation - retention, discovery, and key-management evidence mapping
• ThreatHawk SIEM - detect anomalous access to repositories that may store account data

Frequently Asked Questions

What is SAD versus account data?

Sensitive authentication data (SAD) includes full track data, card verification codes, and PINs/PIN blocks (3.3.1.1-3.3.1.3). Account data is broader; PAN storage is governed by 3.5.x.

Is full-disk encryption enough to protect stored PAN?

Not by itself on non-removable media. 3.5.1.2 limits disk/partition encryption as the sole PAN protection; PAN must also meet 3.5.1 (for example field-level crypto or truncation) on non-removable storage.

What does “masking” require on displays?

3.4.1: when displayed, BIN and last four digits are the maximum most personnel may see; only roles with documented business need may see more.

Related PCI Resources

PCI DSS hub · PCI DSS v4.0.1: What Changed · USA v4.0.1 services