Tokenisation
What is Tokenisation?
The process of replacing sensitive data with non-sensitive placeholder values (tokens) that have no exploitable meaning. Tokenisation is widely used in payment card processing to protect cardholder data and reduce PCI DSS scope.
Terms that appear alongside tokenisation
Each of these is named in at least one of the same controls as tokenisation. The number is how many controls name both.
- encryption 5 shared controls
- data protection 3 shared controls
- compliance 3 shared controls
- authentication 3 shared controls
- pci dss 3 shared controls
- audit 2 shared controls
- cybersecurity 2 shared controls
- fips 2 shared controls
Frameworks that govern tokenisation
What the standards actually require on tokenisation
Requirements naming tokenisation across 6 standards, quoted from the control text.
Agencies should protect sensitive data directly by one of: hashing with a secret salt so values cannot be reversed (suited where originals need not be recovered, such as analytics identifiers);
singapore-government-instruction-manual-on-ictss-management-im8::DSP-39 · Render sensitive data unusable if exfiltrated: salted hashing, field-level encryption or tokenisation →Operate payment card data protection per the NRF framework + PCI DSS v4.0.1 + card brand operating rules (Visa + Mastercard + American Express + Discover + JCB + UnionPay + regional schemes).
NRFCS-3 · Payment Card Data Protection and PCI DSS Scope Management →Define data lifecycle management that scales, covering how data is handled at ingestion, how sensitivity is reduced through masking or tokenisation, retention periods, provenance tracking and destruction.
SEC07-BP04 · Define scalable data lifecycle management →The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation.
ISM-1268 · Need-to-know enforcement for database contents →Tokenisation replaces confidential values with unique substitutes, as a virtual card number does.
ffiec-cybersecurity-assessment-tool-cat::D3.PC.Am.Inn.3 · D3.PC.Am.Inn.3 Access and Data Management (Innovative 3) →Advanced control principles for access control (required, with baseline and intermediate, of an AI whose inherent risk is high). On a risk basis, access controls protect collaborative computing devices and applications (networked whiteboards, cameras, micropho...
hkma-cyber-resilience-assessment-framework-c-raf::3.1.A · 3.1 Access control: advanced level →Questions people ask about tokenisation
What is Tokenisation?
Why is Tokenisation important for compliance?
Which compliance frameworks address Tokenisation?
Where can I learn more about Tokenisation?
See how Tokenisation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.