Tokenisation
What is Tokenisation?
The process of replacing sensitive data with non-sensitive placeholder values (tokens) that have no exploitable meaning. Tokenisation is widely used in payment card processing to protect cardholder data and reduce PCI DSS scope.
Terms that appear alongside tokenisation
Each of these is named in at least one of the same controls as tokenisation. The number is how many controls name both.
- encryption 5 shared controls
- data protection 3 shared controls
- compliance 3 shared controls
- authentication 3 shared controls
- pci dss 3 shared controls
- audit 2 shared controls
- cybersecurity 2 shared controls
- fips 2 shared controls
Frameworks that govern tokenisation
What the standards actually require on tokenisation
Requirements naming tokenisation across 6 standards, quoted from the control text.
Operate payment card data protection per the NRF framework + PCI DSS v4.0.1 + card brand operating rules (Visa + Mastercard + American Express + Discover + JCB + UnionPay + regional schemes).
NRFCS-3 · Payment Card Data Protection and PCI DSS Scope Management →Define data lifecycle management that scales, covering how data is handled at ingestion, how sensitivity is reduced through masking or tokenisation, retention periods, provenance tracking and destruction.
SEC07-BP04 · Define scalable data lifecycle management →The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation.
ISM-1268 · The need-to-know principle is enforced for database contents through the application of mi →Protect data at rest and in transit using encryption, masking, or tokenisation appropriate to risk.
DMBOK-DSec-03 · Data Masking and Encryption →HKMA C-RAF Domain 3 PROTECTION + Domain 4 DETECTION. DOMAIN 3 PROTECTION (6 sub-areas): (1) ACCESS CONTROL - identity + access management + privileged access (PAM) + MFA + zero trust + just-in-time access + role-based access + access reviews + offboarding;
HKMA-CRAF-Domain3-4-Protection-Detection · HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel →Data Management Plan (DMP) per ICH E6 + ICH E8(R1) (General Considerations for Clinical Studies) + ICH E9 (Statistical Principles): study database design + EDC system + data capture sources + data collection + data flow + database lock + transfer to statistics...
ICH-E6-DataMgmt-ExternalData-EHRs-RealWorldData-Coord-FDA-EMA · ICH E6 Data Management + External Data + EHR + Real-World Data + Coordination FDA + EMA + PMDA + ICH Family →Questions people ask about tokenisation
What is Tokenisation?
Why is Tokenisation important for compliance?
Which compliance frameworks address Tokenisation?
Where can I learn more about Tokenisation?
See how Tokenisation applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.