PCI DSS requirement 12.3.3 obliges a cryptographic inventory
31 MARCH 2024, GLOBAL
PCI DSS requirement 12.3.3 obliges organizations that handle payment card data to document and review the cryptographic cipher suites and protocols they use. In practical terms, it requires a cryptographic inventory. That requirement predates the quantum conversation, but it produces exactly the input any post-quantum migration needs first.
The link to post-quantum readiness is direct. A cryptographic inventory is the foundation of migration, because an organization cannot migrate cryptography it has not located. Requirement 12.3.3 forces that inventory for payment data, so an organization meeting the requirement already holds a map of where it uses cryptography for its most sensitive data flows.
The reach is wide. Organizations that store, process or transmit payment card data must comply with PCI DSS, which covers a broad range of merchants and service providers. Many organizations therefore already maintain the cryptographic inventory that post-quantum planning depends on, often without framing it as quantum preparation.
Why it matters. PCI DSS 12.3.3 means many organizations already do the hardest first step of post-quantum migration, inventory, as a condition of handling payment card data. Teams can build on that existing inventory rather than start from scratch, extending it to cover quantum-vulnerable algorithms and migration priorities. Recognising the overlap turns a compliance obligation into a head start on quantum readiness.