PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 3 / c3.5
Optimized Data ProtectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.5 Continuous account data discovery and leak prevention

Automate continuous account data discovery across the data estate to detect inadvertent PAN storage outside the defined CDE and remediate automatically.

Quick Wins
Foundational
Efficient
Optimized
Effort: High Impact: Medium Applies to CDE: Yes

Requirement 3

Protect Stored Account Data

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

3.2 Storage of account data is kept to a minimum
  • 3.2.1 Account data storage minimized via retention and disposal policy Your responsibility
3.5 PAN is secured wherever it is stored
  • 3.5.1 PAN rendered unreadable wherever stored (hash/truncation/tokenization/encryption) Covered

How to implement on AWS

Schedule continuous scans with Amazon Macie over S3 and correlate findings in Security Hub. Automate responses (quarantine, encryption, or deletion) with EventBridge + Lambda. Extend discovery to other repositories via integrations. Retain historical evidence of the account data inventory.

Practical implementation

How this control is implemented in each reference architecture:

Reach the optimized state: continuously scan for account data outside the CDE and auto-remediate stray PAN, keeping a historical inventory as evidence.

  1. Schedule recurring Amazon Macie jobs over the account's S3 to detect PAN stored outside the intended CDE location.
    Account-wide data discovery Amazon Macie
  2. Wire EventBridge + Lambda to act on Macie findings automatically, quarantining (restrict policy) or deleting PAN found outside the CDE.
    Account automation EventBridge AWS Lambda
  3. Retain a history of the account-data inventory and remediation actions as compliance evidence.
    Account evidence store Amazon S3

How to validate: Macie jobs run on schedule, and a planted test object outside the CDE triggers automated quarantine/deletion with a logged action.

Avoid: Scanning but only alerting. Without automated remediation, stray PAN lingers between the finding and a human response; wire the remediation.

Single-account, 3-tier →

Operate continuous discovery and automated remediation centrally, so stray PAN in any account is found and handled by one consistent pipeline.

  1. Run continuous Macie discovery from the security tooling account across all CDE (and adjacent) accounts.
    Security tooling account → PCI OU Amazon Macie AWS Organizations
  2. Correlate findings in Security Hub and drive automated remediation through a central EventBridge bus, so every account is handled the same way.
    Security tooling account Security Hub EventBridge AWS Lambda
  3. Deliver the discovery inventory and remediation history to the log-archive account for retention.
    Log archive account Amazon S3

How to validate: The delegated-admin Macie covers all accounts, Security Hub shows correlated findings, and a planted test object in any CDE account is auto-remediated by the central pipeline.

Avoid: Per-account discovery pipelines with divergent logic. Centralize discovery and remediation so coverage and response are uniform and auditable.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine files and records where account data is stored to verify the stored amount and retention do not exceed the retention policy, and observe that data is rendered unrecoverable when purged (3.2.1.b, 3.2.1.c).
  • Examine data repositories and audit logs to verify PAN is rendered unreadable wherever it resides (3.5.1.b).

Evidence in AWS

  • Scheduled Amazon Macie jobs and their findings history.
  • Remediation automations (EventBridge/Lambda) and their execution log.
  • Historical inventory of account data locations.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 3.2 — Account data is retained only where necessary and for the least amount of time needed, and is securely deleted or rendered unrecoverable when no longer needed.
  • 3.5 — Cleartext PAN cannot be read from storage media.

AWS services

Amazon Macie AWS Security Hub Amazon EventBridge AWS Lambda

Learning resources

References

  • AWS Security Maturity Model: Sensitive data discovery (automated)