DM-10—Primary Account Number Data Restrictions

>Control Description

Organization restricts primary account number (PAN) data such that only the first six and last four digits are displayed; authorized users with a legitimate business need may be provided the full PAN.

Theme

Technology

Type

Preventive

Policy/Standard

Data Management Policy

>Implementation Guidance

1. Ensure that a process is defined and documented for redaction of credit card data. 2. Ensure that the organization restricts primary account number (PAN) data such that only the first six and last four digits are displayed. 3. Ensure that a process is defined to provide full PAN to authorized users with a legitimate business need.

>Testing Procedure

1. Inspect and validate whether a documented process exists for redaction of credit card data. 2. Validate that primary account number is stored such that only the first six and last four digits are displayed. 3. Inspect and validate whether a documented process exists to provide full PAN to authorized users with a legitimate business need.