This is pretty much a PCI DSS requirement for anyone that directly handles PANs.