Storing only BIN part of PAN, does this qualify as a full PAN?

Question

We are looking at becoming PCI-DSS complaint. We wish to minimize the impact it will have on us and our business. As this can be a very expensive exercise. As I understand it if you do not store cardholder data that decrease risk.

My question is if we store only the BIN part of the PAN does this qualify as cardholder data? We wish to store the BIN in combination with the Cardholder Name.

Any clarification would be greatly appreciated.

Answer 1

Storing only the BIN part of the PAN does not qualify as a full PAN. When you are thinking about PAN storage, you have to consider Requirement 3: Protect Stored carholder data. Your question is answered by requirement 3.4 (this is an extract of the navigating PCI-DSS document):

3.4 Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: One-way hashes based on strong cryptography (hash must be of the entire PAN), Truncation (hashing cannot be used to replace the truncated segment of PAN), Index tokens and pads (pads must be securely stored), Strong cryptography with associated key-management processes and procedures

What you are trying to do is referred as "Truncation", limited to the first six digits:

The intent of truncation is that only a portion (not to exceed the first six and last four digits) of the PAN is stored.