Explains PCI DSS requirements on stored card data
Sensitive authentication data is never retained after authorisation (Req. 3.3.1); PAN is unreadable wherever stored (Req. 3.5.1); v4.0.1 is the version in force.
Can AI do this?
AI does this well Most of the tested AI models master this. 3 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 100% | Mastered |
| gemini-3.5-flash-lite | Low cost | 88% | Not shown |
| gpt-6-luna | Low cost | 100% | Mastered |
| claude-haiku-5-5 | Low cost | 100% | Mastered |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: Sensitive authentication data is never retained after authorisation (Req. 3.3.1); PAN is unreadable wherever stored (Req. 3.5.1); v4.0.1 is the version in force.
How it is assessed: Answers a written question on the PCI DSS stored-data requirements correctly
Related knobits
Builds on
Needed for
- S-104 Recognises a requirement cited to the wrong article or version
- S-109 Recognises a control unable to satisfy its requirement
- S-205 Recognises stored sensitive authentication data
- S-209 Recognises a derivation rule leaving data identifying
All 17 knobits of Register regulatory security requirements.
Source: Practice the stage 1 reference and review checklist rest on