Whenever PAN is shown, it must be masked so that no more than the BIN and the last four digits appear, and only staff with a legitimate business need may view more digits than that. Guidance advises showing only as many digits as each business function requires (for example only the last four, or only the BIN for routing), and stresses that masking (hiding digits on display while the full number may remain stored) differs from truncation (digits removed and unrecoverable). Applicability: stricter legal or payment brand rules for displays, such as POS receipt requirements, still apply; this covers PAN on screens, paper receipts, printouts and similar, and is separate from Requirement 3.5.1 on protecting PAN in storage, processing or transmission. Customized approach objective: PAN displays show the smallest number of digits needed for a defined business need.
This control maps to 25 controls across 11 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
PCI DSS 4.0 3.4.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.
The graph holds this control, the 25 it maps to, and the evidence behind each claim, over MCP and REST.