{"id":3438,"date":"2020-11-22T11:16:00","date_gmt":"2020-11-22T11:16:00","guid":{"rendered":"http:\/\/10.24.225.70\/?p=3438"},"modified":"2026-04-09T13:16:26","modified_gmt":"2026-04-09T11:16:26","slug":"can-tokenization-reduce-pci-dss-audit-scope","status":"publish","type":"post","link":"https:\/\/complior.se\/en\/can-tokenization-reduce-pci-dss-audit-scope\/","title":{"rendered":"Can tokenization reduce PCI DSS audit scope?"},"content":{"rendered":"
\n
\n
<\/svg><\/span>Tillbaka till resurser<\/span><\/a><\/div>\n\n\n\nBlog<\/span>\n\n\n\n

Can tokenization reduce PCI DSS audit scope?<\/h1>\n\n\n\n
\r\n\t\r\n\t\t<\/rect>\r\n\t\t<\/line>\r\n\t\t<\/line>\r\n\t\t<\/line>\r\n\t<\/svg>\r\n\t\r\n\t\tNov 22, 2020\t<\/span>\r\n<\/div>\n\n\n

<\/svg><\/span>2 min <\/span><\/h1><\/div>\n<\/div>\n\n\n\n
\"image<\/figure>\n<\/div><\/div>\n\n\n\n
\n
\n

Background<\/h2>\n\n\n\n

In a not recent, but still valid Gartner report, Using Tokenization to Reduce PCI Compliance Requirements, it was found that large merchants with an average of 100,000 customer accounts potentially store cardholder data in 10\u201320 different locations in-house.<\/p>\n\n\n\n

Since the PCI standard mandates that every system in the Cardholder Data Environment (CDE) must be audited, this common scenario creates many potential vulnerabilities.<\/p>\n\n\n\n

A large number of storage locations increases the audit scope, which in turn requires more resources and time, resulting in higher costs.<\/p>\n<\/div>\n\n\n\n

\n

Can you reduce PCI scope?<\/h2>\n\n\n\n

Many merchants ask if there is a way to entirely eliminate the existence of cardholder data from the merchant environment in order to reduce audit scope.<\/p>\n\n\n\n

The answer is yes, and the solution is tokenization<\/a>.<\/p>\n\n\n\n

\"\"<\/figure>\n<\/div>\n\n\n\n
\n

What is tokenization?<\/h2>\n\n\n\n

Tokenization replaces cardholder data with an \u201calias\u201d, a separate randomly generated value called a token. The sensitive data is stored securely in a central token vault, while only token values are used and stored locally in applications and services. When needed, the process can be reversed through de-tokenization, where the token is translated back into the original data.<\/p>\n\n\n\n

Tokenization can be implemented in different ways:<\/p>\n\n\n\n