Compliance Assessment
Which privacy obligations your data puts at risk.
An article-by-article assessment of the personal information found against the active framework — the evidence behind each obligation, and the actions to close the gaps.
Framework
PCI_DSS
Active compliance framework
12 PII types
assessed
Articles triggered
8/8
Framework articles engaged
PCI_DSS
active framework
Special category
0
GDPR Art 9 / sensitive
0 types
special-category
Restricted
608,760
Most-sensitive findings
67% of findings
restricted items
Risk posture
88
Exposure index
Elevated exposure
A high share of identifiable records carry restricted-grade PII (TFN, Medicare, passport), concentrated in a small number of documents.
608,760 restricted-grade findingsCompliance assessment
402,315 scanned · 7,442 partial · 3,803 declined · 23,797 excluded · 240 failed
Top actions to take
- 1.PCI-3.2Any file containing a CVV-like 3-4 digit value near a PAN is a DSS 3.2 violation — investigate immediately.
- 2.PCI-3.2Confirm no application logs, backups, or transaction records retain sensitive authentication data post-auth.
- 3.PCI-3.3Every file with a full PAN (16-digit unmasked) is a potential masking violation — identify the display/export pipeline that produced it.
- 4.PCI-3.3Restrict file access to roles with documented legitimate business need to see full PANs.
- 5.PCI-3.5Redact or tokenise PAN in every file where cleartext is found.
- 6.PCI-3.5Document key management for any encrypted PAN stores in scope.
- 7.PCI-4.2Audit any file-sharing path (email attachments, shared links) carrying files with PAN for encryption in transit.
- 8.PCI-4.2Reject files with plaintext PAN from any outbound channel without TLS enforcement.
Article-by-article assessment
PCI-3.2
Requirement 3.2 — Do not store sensitive authentication data after authorization
Sensitive authentication data (full track, CAV2/CVC2/CVV2/CID, PINs) must not be stored after authorization, even if encrypted.
Evidence from this scan
| PII type | Sensitivity | Findings | Files |
|---|---|---|---|
| Credit Card Number | restricted | 2,462 | 302 |
Recommended actions
- Any file containing a CVV-like 3-4 digit value near a PAN is a DSS 3.2 violation — investigate immediately.
- Confirm no application logs, backups, or transaction records retain sensitive authentication data post-auth.
PCI-3.3
Requirement 3.3 — Mask PAN when displayed
PAN must be masked when displayed (first six / last four maximum). Full PAN only permissible for those with a legitimate business need.
Evidence from this scan
| PII type | Sensitivity | Findings | Files |
|---|---|---|---|
| Credit Card Number | restricted | 2,462 | 302 |
Recommended actions
- Every file with a full PAN (16-digit unmasked) is a potential masking violation — identify the display/export pipeline that produced it.
- Restrict file access to roles with documented legitimate business need to see full PANs.
PCI-3.5
Requirement 3.5 — Protect stored PAN with strong cryptography
PAN stored electronically must be rendered unreadable (one-way hash, truncation, index tokens, or strong cryptography).
Evidence from this scan
| PII type | Sensitivity | Findings | Files |
|---|---|---|---|
| Credit Card Number | restricted | 2,462 | 302 |
Recommended actions
- Redact or tokenise PAN in every file where cleartext is found.
- Document key management for any encrypted PAN stores in scope.
PCI-4.2
Requirement 4.2 — Encrypt PAN during transmission
PAN transmitted over open, public networks must be protected with strong cryptography and security protocols (e.g. TLS 1.2+).
Evidence from this scan
| PII type | Sensitivity | Findings | Files |
|---|---|---|---|
| Credit Card Number | restricted | 2,462 | 302 |
Recommended actions
- Audit any file-sharing path (email attachments, shared links) carrying files with PAN for encryption in transit.
- Reject files with plaintext PAN from any outbound channel without TLS enforcement.
PCI-7.2
Requirement 7.2 — Restrict access to cardholder data by business need to know
Access to PAN and other cardholder data must be restricted to personnel whose job requires it, using role-based access controls.
Evidence from this scan
| PII type | Sensitivity | Findings | Files |
|---|---|---|---|
| Credit Card Number | restricted | 2,462 | 302 |
Recommended actions
- Review access permissions on files containing PAN — apply least-privilege.
- Flag any files with PAN accessible to broad internal groups or external share links.
PCI-9.4
Requirement 9.4 — Protect media containing cardholder data
Physically secure all media (including electronic storage) that contains cardholder data.
Evidence from this scan
| PII type | Sensitivity | Findings | Files |
|---|---|---|---|
| Credit Card Number | restricted | 2,462 | 302 |
Recommended actions
- Confirm the storage systems hosting the scanned files are in PCI-compliant physical security zones.
- Quarantine any file containing PAN found in user workstations, shared drives, or non-CDE systems.
PCI-10.2
Requirement 10.2 — Audit logs of access to cardholder data
Implement automated audit logs to reconstruct user access to PAN, admin actions, and authentication events.
Evidence from this scan
| PII type | Sensitivity | Findings | Files |
|---|---|---|---|
| Credit Card Number | restricted | 2,462 | 302 |
Recommended actions
- Ensure file-access logging is enabled on storage systems holding PAN-containing files.
- Verify log retention meets PCI's minimum 12-month retention requirement (3 months online).
PCI-12.10
Requirement 12.10 — Incident response plan
Implement and maintain an incident response plan to be activated in the event of a suspected or confirmed security incident involving cardholder data.
Evidence from this scan
| PII type | Sensitivity | Findings | Files |
|---|---|---|---|
| Credit Card Number | restricted | 2,462 | 302 |
Recommended actions
- Treat any externally-shared file containing PAN as a potential incident — invoke the IR plan.
- Validate that the IR plan covers detection, containment, forensics, notification to card brands, and post-incident review.
Payment Card Industry Data Security Standard v4.0 · PCI Security Standards Council