Visa Inc. · NYSE:V
Visa — Technical Presentation (January 2022)
11 slides from Visa's technical presentation, Jan 13, 2022
Slide 1: Numerics Initiative 8-Digit BIN PCI Webinar
Numerics Initiative 8-Digit BIN PCI Webinar Presenter: Chackan Lai Date: 13 January 2022
Slide 2: Agenda
Agenda • 8-Digit Issuing BIN Overview • PCI DSS Requirements • PAN Masking • PAN Unreadable ‒ PAN Hashing ‒ PAN Truncation • PCI FAQ 1091 ‒ PAN Encryption • PCI FAQ 1086 • PCI DSS Requirements and Solutions • Q&A
Slide 3: 8-Digit Issuing BIN Overview
8-Digit Issuing BIN Overview 1 To address an industry shortage, the 2 Visa is supporting this change with a 3 Clients should be well underway now International Organization for client-focused plan; most of the with their cross-functional plans to Standardization (ISO) expanded the impacts are within
Slide 4: PCI DSS Requirements: 3.3 PAN Masking
PCI DSS Requirements PCI 3.3 - PAN Masking DSS Requirement PAN Masking Definition and Description • Only applies to the Mask PAN when Masking is a method of display of PAN in displayed (first six and concealing a segment of receipts, screens, last four digits are the PAN when displayed or printouts
Slide 5: PCI DSS Requirements: 3.4 Render PAN Unreadable
PCI DSS Requirements PCI 3.4 – Render PAN Unreadable DSS Requirement PCI 3.4 Render PAN Unreadable1 Definition and Description Only applies to PAN when Render PAN unreadable anywhere it is stored One-way Hash stored (including on portable digital media, backup media, A one-way function based on a cr
Slide 6: PAN Hashing
PCI DSS Requirements PAN Hashing • No changes with migration to 8-digit Cardholder Data Environment In Scope* Truncated Database PAN Exp In Scope* 5FD924625F6AB16A19490E4BA675F843D5A1 12/30 A665A45920422F9D411F3FFF1FA07E998E86F 12/30 CC9807C7C506AE18137E4867EFDC4FB8A04A 12/30 4A0743E6B87F074864C2FAE
Slide 7: PAN Truncation
PCI DSS Requirements PAN Truncation • Maximum allowed to be displayed is first 8 and any other 4. This applies to PANs with either 6- or 8-digit BINs • Truncated PAN database – Out of scope for PCI DSS Cardholder Data Environment In Scope* Truncated Database PAN Exp Out of 4012 0010---- 1414 12/30 S
Slide 8: FAQ 1091: Acceptable formats for truncation of primary account numbers
PCI DSS Requirements PCI FAQ 1091* - What are acceptable formats for truncation of primary account numbers? Link to PCI FAQ PAN/BIN Length Payment Brand Acceptable PAN Truncation Formats Type "1091" in Search At least 6 digits removed. Maximum digits which may be box and click submit. retained: >16-
Slide 9: PAN Encryption
PCI DSS Requirements PAN Encryption • No changes with migration to 8-digit BIN • Use of strong cryptography as defined in PCI DSS is required. • Encrypted database MAY be out of scope for PCI DSS assessments – refer to FAQ 1086 In Scope* Encrypted Database PAN Exp Can be IN or KMYaMERC3k73C4I41OuLqQ
Slide 10: FAQ 1086: How does encrypted cardholder data impact PCI DSS scope?
PCI DSS Requirements PCI FAQ 1086 * - How does encrypted cardholder data impact PCI DSS scope? Use of encryption in a merchant environment does not remove the need for PCI DSS in that environment. The merchant environment is still in scope for PCI DSS due to the presence of cardholder data. For exam
Slide 11: Masking vs Truncation vs Encryption – Applicability
PCI DSS Requirements and Solutions Masking vs Truncation vs Encryption – Applicability Requirement PAN Masking PAN Truncation PAN Encryption Yes No No • Requirement 3.3 - Display of PAN • Requirement 3.4 - Storage of PAN using No Yes Yes acceptable methods • Requirement 4.1 - Transmission of PAN No