For now I read PCI compliance document and I don't understand any things.

  I have a program, which takes sensitive and cardholder data as input (some of them are in encrypted form) and then returned back (some of them are in encrypted form).

  I have 2 simple questions:

  1. What elements need to be encrypted as input and output? For now - how I understand ir - only PIN, PAN, track2data and CVV code need to be encrypted.

  2. What elements need to be masked and how should I do it? For now I was saving in the log files only the last 4 digits of the PAN (for example - `***1234`), CVV code is completely masked (for example - `**`), track2data is completely masked and and PIN is completely masked.