Cyber criminals have proved adept at thwarting existing IT defenses and exploiting weak links in the payments ecosystem. Merchants, service providers, and enterprises thus face severe and ongoing challenges securing card data from capture through the transaction lifecycle. Organizations are also under pressure to achieve scope and cost reduction goals in meeting compliance mandates such as the Payment Card Industry Data Security Standard (PCI DSS). Tokenization – replacing card numbers with tokens – is one method of data protection and audit scope reduction recommended by the PCI DSS Security Standards Council. Reducing audit scope using tokenization can both accelerate initial compliance efforts and reduce costs for future audits.