Tokenization is a data protection technique that replaces a sensitive value, such as a credit card number, with a non-sensitive substitute called a token that has no exploitable meaning outside the system that issued it. The real data is stored separately in a secured token vault, and the token maps back to it only there.
Unlike encryption, a token is not a mathematically reversible version of the original; without access to the vault, it is useless to an attacker. This is why payment processors rely on it so heavily. A merchant can store and reuse a token for recurring billing while the actual card number never touches its systems, which sharply reduces PCI DSS scope. The point people miss is that tokenization does not remove the need to protect the vault itself; that mapping store becomes the crown jewel and must be hardened accordingly. Format-preserving tokens keep the original length and layout so legacy applications keep working.
Why does tokenization matter for the CISSP exam?
It appears in Domain 2, Asset Security. Be ready to contrast tokenization with encryption and masking, and to explain how it protects data at rest and reduces compliance scope.