[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:pci-dss\u002Frequirement-3":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"pci-dss","requirement-3","Requirement 3.4","Requirement 3: Protect Stored Account Data",29,"PCI Security Standards Council","**What it asks for.** Requirement 3 of PCI DSS v4.0 covers the protection of stored account data. It limits storage to what is necessary, prohibits storing sensitive authentication data after authorisation, restricts display of the full primary account number, requires the PAN to be rendered unreadable wherever it is stored and sets requirements for managing cryptographic keys.\n\n**In practice.** Organisations minimise card data storage through data retention policies and, where possible, tokenisation or outsourcing to reduce scope. Where PAN is stored, it is protected with strong cryptography or other approved methods, display is masked and keys are managed with defined custodians, rotation and secure storage. Evidence includes data discovery results, retention procedures, encryption configuration and key management documentation.\n\n**Common gaps.** Card data often turns up in unexpected places, such as logs, emails, spreadsheets and support tickets. Disk level encryption alone is not sufficient in many cases under v4.0.",null,"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fstandards\u002Fpci-dss\u002F","Read about PCI DSS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"rydox-cybercrime-marketplace-operator-pleads-guilty-to-identity-theft-and-money-laundering","Rydox Cybercrime Marketplace Operator Pleads Guilty to Identity Theft and Money Laundering","2026-09-25T14:21:19.894+00:00",{"slug":23,"title":24,"published_at":25},"origin-energy-breach-exposes-900000-customers-personal-and-financial-data","Origin Energy Breach Exposes 900,000 Customers' Personal and Financial Data","2026-07-28T06:20:34.958+00:00",{"slug":27,"title":28,"published_at":29},"stolen-customer-data-fuels-13m-in-fraudulent-acima-leases","Stolen Customer Data Fuels $13M in Fraudulent Acima Leases","2026-07-22T22:20:18.038+00:00",{"slug":31,"title":32,"published_at":33},"suno-paidwork-breaches-expose-millions-of-financial-records","Suno & Paidwork Breaches Expose Millions of Financial Records","2026-07-22T16:20:36.615+00:00",{"slug":35,"title":36,"published_at":37},"financial-institution-pii-database-exposed-in-underground-market","Financial Institution PII Database Exposed in Underground Market","2026-06-02T15:05:31.957+00:00",{"slug":39,"title":40,"published_at":41},"pos-software-company-suffers-massive-data-exfiltration","POS Software Company Suffers Massive Data Exfiltration","2026-05-31T22:05:45.381+00:00",{"slug":43,"title":44,"published_at":45},"resort-database-breach-exposes-guest-information","Resort Database Breach Exposes Guest Information","2026-05-31T16:06:40.332+00:00",{"slug":47,"title":48,"published_at":49},"financial-services-database-breach-exposes-2m-transactions","Financial Services Database Breach Exposes 2M Transactions","2026-05-27T17:20:30.551+00:00",{"slug":51,"title":52,"published_at":53},"financial-services-database-breach-exposes-2m-transactions-and-payment-card-data","Financial Services Database Breach Exposes 2M Transactions and Payment Card Data","2026-05-27T17:20:20.084+00:00",{"slug":55,"title":56,"published_at":57},"uae-insurance-giant-salama-suffers-data-breach-exposing-80000-customer-records","UAE Insurance Giant Salama Suffers Data Breach Exposing 80,000 Customer Records","2026-04-25T23:09:52.78+00:00",{"slug":59,"title":60,"published_at":61},"massive-credit-card-data-compilation-highlights-data-breach-aggregation-risks","Massive Credit Card Data Compilation Highlights Data Breach Aggregation Risks","2026-04-23T05:09:47.208+00:00",{"slug":63,"title":64,"published_at":65},"taiseer-financial-platform-suffers-pii-data-breach","Taiseer Financial Platform Suffers PII Data Breach","2026-04-20T21:09:44.958+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",22,{"slug":73,"name":74,"problem":75,"stories":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",18,{"slug":78,"name":79,"problem":80,"stories":81},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",12,{"slug":83,"name":84,"problem":85,"stories":86},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",8,{"slug":88,"name":89,"problem":90,"stories":91},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",4,{"slug":93,"name":94,"problem":95,"stories":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",3,[98,104,109,115,120,125,129,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","3","Control 3","Data Protection",28,{"family":99,"item":105,"code":106,"title":107,"together":108},"6","Control 6","Access Control Management",25,{"family":110,"item":111,"code":112,"title":113,"together":114},"gdpr","32","Article 32","Security of processing",23,{"family":116,"item":117,"code":118,"title":119,"together":76},"nist-csf","pr-ds","PR.DS-1","Data Security",{"family":116,"item":121,"code":122,"title":123,"together":124},"pr-ac","PR.AC-1","Identity Management, Authentication and Access Control (CSF 1.1)",13,{"family":110,"item":126,"code":127,"title":128,"together":86},"25","Article 25","Data protection by design and by default",{"family":130,"item":131,"code":132,"title":133,"together":134},"nist-800-53","ac-2","AC-2","Account Management",7,{"family":130,"item":136,"code":137,"title":138,"together":134},"sc-28","SC-28","Protection of Information at Rest"]