3.5.1.2 Disk or partition encryption only on removable media

Where encryption applied to a whole disk or partition, instead of encrypting at database file, column or field level, is what makes PAN unreadable, it may be relied on only (1) on removable electronic media, OR (2) on non-removable electronic media where PAN is additionally made unreadable by another mechanism that satisfies Requirement 3.5.1. Applicability: covers any encryption that automatically presents cleartext PAN when a system runs without a specific user request; such encryption may remain but cannot be the sole protection, so stored PAN also needs truncation or data-level encryption; full disk encryption suits only removable media; data centre media such as hot-swappable drives and bulk tape backups count as non-removable; implementations still have to satisfy every remaining encryption and key-management rule in the standard; for card issuers and issuing-service firms it does not apply to PAN accessed for real-time transaction processing but does apply to PAN stored for other purposes. Objective under the customized approach: encrypted PAN is decrypted only when a legitimate business need to access it exists. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

Source: PCI DSS v4.0.1, 3.5.1.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.