What it asks for. Requirement 3 of PCI DSS v4.0 covers the protection of stored account data. It limits storage to what is necessary, prohibits storing sensitive authentication data after authorisation, restricts display of the full primary account number, requires the PAN to be rendered unreadable wherever it is stored and sets requirements for managing cryptographic keys.
In practice. Organisations minimise card data storage through data retention policies and, where possible, tokenisation or outsourcing to reduce scope. Where PAN is stored, it is protected with strong cryptography or other approved methods, display is masked and keys are managed with defined custodians, rotation and secure storage. Evidence includes data discovery results, retention procedures, encryption configuration and key management documentation.
Common gaps. Card data often turns up in unexpected places, such as logs, emails, spreadsheets and support tickets. Disk level encryption alone is not sufficient in many cases under v4.0.