3.3.1.3 PIN and PIN block not stored after authorization
Personal identification number (PIN) and the encrypted PIN block are not retained after authorization.
5
artefacts
2
held by a system
2
at each review
moderate
to go live
Key management / PKI
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- HSM transaction logs showing PIN destruction · Key management / PKI
- Data discovery scan · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
- Application code review · Source control / CI pipeline
- Vendor attestation · Vendor register / contract repository
governing documentDocuments that govern the control
- Penetration test confirming no PIN at rest · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Key management / PKI); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- PIN block in transaction archive
- Encrypted PIN retained for analytics
- HSM not used for PIN handling
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet3.3.1.2 Card verification code not stored after authorization · 3.3.2 SAD stored prior to authorization is encrypted