Can I separately store 8-digit BINs and truncated (6/4) PANs outside of my CDE?
Truncated PANs are no more than the first 6 and last 4 digits of PAN, compliant to the standard's section 3.4, but it only says:
The intent of truncation is to permanently remove a segment of PAN data so that only a portion of the PAN is stored.
from which I am not sure if it's still allowed to have the first 8 digits separately, for other purposes, let's say, to maintain a mapping from BIN to bank name.
Current standard: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
Also a note from https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/What-are-acceptable-formats-for-truncation-of-primary-account-numbers and https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/Are-truncated-Primary-Account-Numbers-PAN-required-to-be-protected-in-accordance-with-PCI-DSS which makes sense but I didn't find anything similar in the standard:
Access to different truncation formats of the same PAN greatly increases the ability to reconstruct full PAN, and the security value provided by an individual truncated PAN is significantly reduced. If the same PAN is truncated using more than one truncation format (for example, different truncation formats are used on different systems), additional controls should be in place to ensure that the truncated versions cannot be correlated to reconstruct additional digits of the original PAN.
I checked related Q&As, none of which mentions 8-digits:
- Storing last 6 digits of payment card vs 4 digits
- Minimum requirements for storing last 4 digits of credit card number?
- Is PCI-DSS compliance required for non-credit card payment source?
- Creditcard store first six digits PCI reference
- PCI Compliance requirement when storing card data on user's device
- Does transmitting first 6 and last 4 digits of the card number and expire date require PCI DSS compliance?