[{"data":1,"prerenderedAt":91},["ShallowReactive",2],{"news-\u002Fnews\u002Fpci-dss-12-3-3-cryptographic-inventory":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":43,"date":44,"description":45,"draft":46,"extension":47,"faqs":48,"findingsSource":8,"geo":58,"image":60,"industries":61,"keyFindings":8,"meta":64,"modified":65,"navigation":66,"path":67,"pullquote":8,"recommendations":8,"references":68,"related":72,"seo":79,"seoTitle":80,"signposts":8,"slug":81,"stats":8,"stem":82,"tags":83,"tldr":89,"__hash__":90},"news\u002Fnews\u002Fpci-dss-12-3-3-cryptographic-inventory.md","PCI DSS Requirement 12.3.3 Obliges a Cryptographic Inventory","ArcQubit Team","",null,{"type":10,"value":11,"toc":39},"minimark",[12,17,24,27,30,33],[13,14,16],"h2",{"id":15},"pci-dss-requirement-1233-obliges-a-cryptographic-inventory","PCI DSS requirement 12.3.3 obliges a cryptographic inventory",[18,19,20],"p",{},[21,22,23],"strong",{},"31 MARCH 2024, GLOBAL",[18,25,26],{},"PCI DSS requirement 12.3.3 obliges organizations that handle payment card data to document and review the cryptographic cipher suites and protocols they use. In practical terms, it requires a cryptographic inventory. That requirement predates the quantum conversation, but it produces exactly the input any post-quantum migration needs first.",[18,28,29],{},"The link to post-quantum readiness is direct. A cryptographic inventory is the foundation of migration, because an organization cannot migrate cryptography it has not located. Requirement 12.3.3 forces that inventory for payment data, so an organization meeting the requirement already holds a map of where it uses cryptography for its most sensitive data flows.",[18,31,32],{},"The reach is wide. Organizations that store, process or transmit payment card data must comply with PCI DSS, which covers a broad range of merchants and service providers. Many organizations therefore already maintain the cryptographic inventory that post-quantum planning depends on, often without framing it as quantum preparation.",[18,34,35,38],{},[21,36,37],{},"Why it matters."," PCI DSS 12.3.3 means many organizations already do the hardest first step of post-quantum migration, inventory, as a condition of handling payment card data. Teams can build on that existing inventory rather than start from scratch, extending it to cover quantum-vulnerable algorithms and migration priorities. Recognising the overlap turns a compliance obligation into a head start on quantum readiness.",{"title":7,"searchDepth":40,"depth":40,"links":41},2,[42],{"id":15,"depth":40,"text":16},"Policy","2024-03-31","PCI DSS requirement 12.3.3 obliges organizations handling payment card data to inventory their cryptography, which is the foundation for post-quantum migration.",false,"md",[49,52,55],{"q":50,"a":51},"What does PCI DSS 12.3.3 require?","Requirement 12.3.3 obliges organizations that handle payment card data to document and review the cryptographic cipher suites and protocols they use. In effect, it requires a cryptographic inventory, which is exactly the first step any post-quantum migration needs.",{"q":53,"a":54},"How does 12.3.3 relate to post-quantum readiness?","A cryptographic inventory is the foundation of post-quantum migration, because an organization cannot migrate cryptography it has not located. Requirement 12.3.3 forces that inventory for payment data, so compliance already produces a key input for quantum planning.",{"q":56,"a":57},"Who must meet PCI DSS 12.3.3?","Organizations that store, process or transmit payment card data must comply with PCI DSS, including requirement 12.3.3. That covers a wide range of merchants and service providers, so many organizations already hold the cryptographic inventory that post-quantum planning requires.",[59],"global","\u002Fassets\u002Fog-default.png",[62,63],"Financial Services","Information Technology",{},"2026-08-18",true,"\u002Fnews\u002Fpci-dss-12-3-3-cryptographic-inventory",[69],{"label":70,"url":71},"PCI Security Standards Council, \"Payment Card Industry Data Security Standard v4.0, Requirement 12.3.3,\" 2024.","https:\u002F\u002Fwww.pcisecuritystandards.org\u002F",[73,76],{"label":74,"url":75},"BIS Papers No. 158 Urges Banks to Start Post-Quantum Work Now","\u002Fnews\u002Fbis-papers-158-start-post-quantum-now",{"label":77,"url":78},"CISA, NSA and NIST Urge Organizations to Start Quantum-Readiness Planning","\u002Fnews\u002Fcisa-nsa-nist-quantum-readiness-factsheet",{"title":5,"description":45},"PCI DSS 12.3.3 Requires a Cryptographic Inventory","pci-dss-12-3-3-cryptographic-inventory","news\u002Fpci-dss-12-3-3-cryptographic-inventory",[84,85,86,87,88],"financial services","cryptographic discovery","federal compliance","quantum readiness","for enterprises","PCI DSS requirement 12.3.3 obliges organizations handling payment card data to inventory their cryptography, a step that doubles as the foundation for post-quantum migration.","yWuLLlnRBL_Xf2fdsymXUqef_K3_iwLFO4JhYdq-06U",1792182887159]