Our organization has been asked to comply with PCI DSS.
As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication data. That is like 7 types of data (i.e PAN, cardholder name, service code, expiration date, full magnetic stripe, validation code, PIN) We have tried some tools that search files and helps us to identify PANs, but none of them identify patterns for the rest of the data types such as service code, full magnetic stripe or validation code which are sensitive data and according to PCI should not be stored whatsoever. How could we perform a similar scanning in a database?
What would be the best technical way to demonstrate we don't store any of that data?