In the context of rendering cardholder data unreadable, hashing should be applied to which data?

• A. The last four digits of the PAN
• B. The cardholder's name
• C. The entire PAN
• D. The PIN

Answer: (C)

When you want to render cardholder data unreadable, the focus is on protecting the primary account number (PAN) wherever it is stored. Hashing the entire PAN turns it into a one-way digest, so the original number can’t be recovered. If you only hash the last four digits, the majority of the PAN would still be stored in readable form, so the data isn’t truly unreadable. The cardholder’s name isn’t the sensitive value that defines the card account, and the PIN is handled in a different, highly protected way during authorization. So hashing the entire PAN is the correct approach to ensure the data is unreadable.