Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are looking at becoming PCI-DSS complaint. We wish to minimize the impact it will have on us and our business. As this can be a very expensive exercise. As I understand it if you do not store cardholder data that decrease risk.

My question is if we store only the BIN part of the PAN does this qualify as cardholder data? We wish to store the BIN in combination with the Cardholder Name.

Any clarification would be greatly appreciated.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Storing only the BIN part of the PAN does not qualify as a full PAN. When you are thinking about PAN storage, you have to consider Requirement 3: Protect Stored carholder data. Your question is answered by requirement 3.4 (this is an extract of the navigating PCI-DSS document):

3.4 Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: One-way hashes based on strong cryptography (hash must be of the entire PAN), Truncation (hashing cannot be used to replace the truncated segment of PAN), Index tokens and pads (pads must be securely stored), Strong cryptography with associated key-management processes and procedures

What you are trying to do is referred as "Truncation", limited to the first six digits:

The intent of truncation is that only a portion (not to exceed the first six and last four digits) of the PAN is stored.

share|improve this answer
    
Hi Gael. Thank you for the answer. My question then is if I truncate the PAN to first 6 digits. Totally discarding the rest in memory. Do I still need to comply with section 3.4? –  Rup Jul 26 '12 at 9:47
    
Not sure I fully understand the question. First of all, let me clarify that requirement 3.4 is only about persistent storage. If you only store the PAN in RAM, you don't have to comply with 3.4 (truncated or not). If you are storing the PAN on disk, you have to comply with 3.4. One way of doing so is by truncation. –  Gael Muller Jul 26 '12 at 9:59
    
Thank you. That clears it up for me. Even if truncated if stored on disk 3.4 will apply. –  Rup Jul 26 '12 at 10:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.