PANScout
Where would you look for a card number outside your ecommerce checkout?
Begin with the files people create around the transaction. Reconciliation, customer support, disputes and migrations each provide a useful process to examine. The question is whether any of those workflows creates or retains full primary account numbers, or PAN, beyond the locations you expect.
These are candidate areas for investigation, not an assumption that your store holds card data in all of them.
Follow one export from creation to disposal.
Choose a relevant workflow and trace its files. Who produces the export? Which fields does it contain? Where is it saved, who uses it and what happens to working copies?
Possible locations to consider include finance exports, shared reconciliation folders, dispute-document collections, support attachments and historical migration files. Narrow the list using your actual data flows and approved access.
Do not export more payment data simply to make it easier to scan. Begin with files already held in authorised locations, and use your organisation's approved handling process for anything that requires separate access.
Distinguish file discovery from application coverage.
Scanning an export tests the content of that export. It does not inspect every record in the originating application or establish coverage of a hosted shop, payment provider, support platform or live database.
PANScout inspects supported files accessible to the machine running it, including through operating-system-mounted shares where access is authorised. It does not upload those files to PANScout for analysis. Its file workflow should not be presented as a direct integration with your commerce or payment systems.
Record the selected files and exclusions, then preserve actual coverage outcomes. An inaccessible archive or unreadable document is follow-up work, not evidence that no card data is present.
Evaluate with a small, controlled selection.
Use the safe sample report and product demonstration to understand the workflow before selecting your own material. For a first approved evaluation, choose a manageable folder whose purpose and ownership are understood.
Review masked candidates in context. Record why a result is confirmed, test material or not a PAN. Keep raw card data out of support requests and routine tickets, and handle any remediation through your existing controls.
Check the process that creates the file.
If you confirm unexpected card data, investigate the source as well as the saved copy. Could a report omit a field that users do not need? Does a migration leave historical exports behind? Are working copies covered by the retention process?
Those are organisational decisions. A scanner supplies discovery evidence; it does not decide retention justification or automatically remove source material.
Repeat the relevant inspection after approved changes and retain the new coverage and review record. A scan with no findings does not prove the absence of PAN elsewhere, determine PCI DSS scope or guarantee compliance.
Read the stored-card-data discovery guide for the full planning workflow, or open the sample evidence report to review the output. When ready to evaluate the file inspection and review process, start the 14-day trial.
CONTINUE READING