PCI-DSS v4: Why Protecting PAN Data Just Got Harder

PCI-DSS v4 significantly raises the bar for how organizations protect Primary Account Numbers (PAN) and cardholder data. Controls that were acceptable under v3—such as disk-level or volume-level encryption—no longer meet the intent of v4, which emphasizes database column-level encryption, least privilege, and protection of sensitive data not only at rest, but also in use.

For Global 2000 organizations that store PAN in operational databases, analytics platforms, and increasingly feed it into cloud and AI pipelines, this creates a difficult challenge: how to encrypt PAN without breaking applications, exploding costs, or introducing new operational risk.

Why Disk-Level Encryption Is No Longer Enough

Many organizations historically relied on disk-level encryption to meet PCI-DSS v3 requirements. Under PCI-DSS v4, this approach is insufficient because:

• PAN remains exposed to privileged users, applications, and queries once the database is running
• There is no granular control over who can see decrypted PAN
• Auditors increasingly expect column-level protection and runtime controls, not just encrypted storage

As a result, organizations are forced to reconsider how PAN is protected inside databases and data platforms.

The Cost and Complexity of Column-Level Encryption

One common response is moving from disk-level to column-level encryption. However, this shift is often expensive, disruptive, and slow.

Native Database Encryption

Technologies such as Oracle and Microsoft SQL Server Transparent Data Encryption (TDE) can encrypt columns at the database layer without requiring applications to explicitly call decryption functions.

However:

• These solutions are very costly
• They are limited to Oracle and SQL Server databases and do not address heterogeneous environments with multiple database and cloud platforms

External Encryption and Tokenization Platforms

Vendors such as Protegrity and Thales offer column-level encryption and tokenization, typically implemented through external User-Defined Functions (UDFs).

While cryptographically strong, this model introduces significant operational friction:

• Applications must be modified to call UDFs by creating and maintaining database views
• Views must be created and protected to read encrypted data, while writes go to base tables
• Data pipelines, analytics jobs, and integrations must all be updated, ensuring clear-text data is encrypted consistently and synchronizally across all data platforms

For large, legacy, or highly regulated environments, these code changes become a deployment blocker.

Driver-Based and Gateway Approaches

OpenText Voltage provides JDBC/ODBC drivers and REST gateways that rewrite application queries to encrypt and decrypt PAN transparently.

While this reduces some code changes, it introduces other challenges:

• Limited or inconsistent support for .NET, Python, Node.js, Go, and legacy applications
• Added architectural components in the data path
• Increased operational complexity and new failure domains

A Different Approach: Best-of-breed approach that combines Column-level encryption at-Rest and Dynamic Encryption In-Use

SecuPi has been replacing OpenText Voltage encryption at-Rest in large financial organizations as it includes wider Enforcer technology support beyond just ODBC/JDBC drivers.

It also enables to implement a much faster PCI-DSS compliance using dynamic encryption and dynamic masking at runtime, as data is accessed—without modifying databases or applications.

Using its Enforcers, SecuPi:

• Monitors all access to PAN and cardholder data
• Dynamically encrypts or masks PAN in-use or at-rest, based on identity, role, purpose, and context
• Works consistently across cloud and on-prem environments, databases, analytics platforms, and applications

Crucially, PAN remains in its original format at rest, avoiding downstream data breakage.

Why Dynamic Encryption Aligns Better with PCI-DSS v4

Dynamic encryption directly addresses PCI-DSS v4 expectations while reducing operational risk:

Key benefits for PCI-DSS v4 compliance

1. Up to 10× faster deployment compared to Protegrity, OpenText Voltage and Thales column-level encryption projects
2. No risk of encrypted PAN proliferating into downstream systems, analytics, or backups
3. Zero code changes to applications, databases, analytics environments, or data pipelines

For CISOs under audit pressure, this approach delivers strong cryptography, least-privilege access, and runtime protection—without the cost, delay, and fragility of traditional encryption models.