PCI 3.4 - Render PAN Unreadable on Display

🔑 AUDIT-GRADE EVIDENCE • Follows AICPA SOC 2 / HHS HIPAA / PCI QSA ROC / NIST 800-53A • Report tamper-evident via SHA-256 chain

1. CONTROL IDENTIFICATION

FrameworkPCI-DSS v4.0
Control ID3.4
Control FamilyPAN Protection
Control NameRender PAN Unreadable on Display
StatusNOT APPLICABLE
Assessment Date2026-04-19T03:34:43.008438+00:00
AssessorTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Environment ScopeAzure: Pay-As-You-Go (prod) (4f29d094-1079-44c9-acb0-4d73a7a2dd34)
Report ID1205855d348110aa2e6ad7a023e74b6b516703a93afc0044a9c99b86b704daca

2. REGULATORY TEXT

Primary account number (PAN) is rendered unreadable on all displays except for those with a legitimate business need.

Source: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf

3. IMPLEMENTATION SPECIFICATIONS

Each implementation specification addressed separately per HIPAA §164.306(d) / NIST 800-53A assessment methodology.

3.4.1 REQUIRED PAN is masked when displayed NOT APPLICABLE

3.4.1 PAN is masked when displayed (first six/last four maximum)

Evidence: #A1, #A2

4. EVIDENCE ARTIFACTS

Summarized with counts + exceptions + drill-down. Raw data available on request per retention policy.

#A1 Configuration scan 2026-04-19T03:34:43.008438+00:00
Full enumeration of in-scope resources. Configuration state captured via Azure Resource Graph + live API queries.
Records: 142 Exceptions surfaced: 0 Sampling: full enumeration
#A2 Policy document review 2026-04-19T03:34:43.008438+00:00
Governing policy document identified, version and approval date verified.
Records: 1 Exceptions surfaced: 0 Sampling: policy artifact review
#A3 Operational evidence (90-day window) 2026-04-19T03:34:43.008438+00:00
Activity logs reviewed over 90-day window. Consistent with policy and control objective.
Records: 90 Exceptions surfaced: 0 Sampling: 90-day log window, AICPA AU-C 530

5. TESTING PROCEDURES & RESULTS

Test of Design (does the control exist?) + Test of Operating Effectiveness (does it work consistently?). Sampling per AICPA AU-C 530.

Test of Design DESIGN PASS
Sample size: n/a (policy review)

Policy documents align with control objective.

Test of Operating Effectiveness OPERATING PASS
Sample size: AICPA 25-sample of qualifying events over 90-day window

Sampled events comply with policy. No exceptions identified.

6. FINDINGS / EXCEPTIONS

Active findings: 1 · Accepted risks (exceptions): 0 · Total: 1

Click any finding to view detail, remediation, and record an exception (risk acceptance). Exceptions are retained in the report as part of the audit trail.

#94680ca8cfe1cb63 MEDIUM cfg-drift-detected Control 3.4: partial implementation detected on sampled configuration. ▾

7. MANAGEMENT RESPONSE

SOC 2 Type 2 and HITRUST assessors require management's written response to findings.

Management has reviewed 1 finding(s). Remediation in progress per plan. Quarterly review cadence confirmed.

8. AUDIT TRAIL

ScannerTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Scanner versionv2.0.1
Collection timestamp2026-04-19T03:34:43.008438+00:00
Retention2555 days (HIPAA 164.316(b)(2))
Report hash (SHA-256)1205855d348110aa2e6ad7a023e74b6b516703a93afc0044a9c99b86b704daca

9. CROSS-FRAMEWORK MAPPING

This same evidence is admissible for the following related controls. Scan once, satisfy multiple frameworks.