r3.5 Continuous account data discovery and leak prevention
Automate continuous account data discovery across the data estate to detect inadvertent PAN storage outside the defined CDE and remediate automatically.
AWS services
Amazon Macie 
AWS Security Hub 
Amazon EventBridge 
AWS Lambda Requirement 3
Protect Stored Account Data
PCI sub-requirements covered
- 3.2 Storage of account data is kept to a minimum
- 3.5 PAN is secured wherever it is stored
How to implement on AWS
Schedule continuous scans with Amazon Macie over S3 and correlate findings in Security Hub. Automate responses (quarantine, encryption, or deletion) with EventBridge + Lambda. Extend discovery to other repositories via integrations. Retain historical evidence of the account data inventory.
Practical implementation
How this control is implemented in each reference architecture:
Schedule recurring Macie scans over the account's S3 and wire EventBridge + Lambda to quarantine or delete any PAN found outside the CDE, keeping a history of the account-data inventory.
Single-account, 3-tier →Operate continuous Macie discovery from the security tooling account across all CDE (and adjacent) accounts, correlate in Security Hub, and drive automated remediation via a central EventBridge bus so stray PAN in any account is handled consistently.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine files and records where account data is stored to verify the stored amount and retention do not exceed the retention policy, and observe that data is rendered unrecoverable when purged (3.2.1.b, 3.2.1.c).
- Examine data repositories and audit logs to verify PAN is rendered unreadable wherever it resides (3.5.1.b).
Evidence in AWS
- Scheduled Amazon Macie jobs and their findings history.
- Remediation automations (EventBridge/Lambda) and their execution log.
- Historical inventory of account data locations.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 3.2 — Account data is retained only where necessary and for the least amount of time needed, and is securely deleted or rendered unrecoverable when no longer needed.
- 3.5 — Cleartext PAN cannot be read from storage media.
Learning resources
References
- AWS Security Maturity Model: Sensitive data discovery (automated)