Requirement 4: Encrypt transmission of cardholder data across open, public networks Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Not Yes CCW No N/A Tested Are strong cryptography and security protocols, such as 4.1 Review documented TLS, SSH or IPSEC, used to safeguard sensitive standards cardholder data during transmission over open, public Review policies and networks? procedures Examples of open, public networks include but are not limited Review all locations where to the Internet; wireless technologies, including 802.11 and CHD is transmitted or received Bluetooth; cellular technologies, for example, Global System Examine system for Mobile communications (GSM), Code division multiple configurations access (CDMA); and General Packet Radio Service (GPRS). Note: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only secure Examine system configurations, and to not support insecure versions or configurations configurations? Is the proper encryption strength implemented for the Review vendor documentation encryption methodology in use (check vendor Examine system recommendations/best practices)? configurations
Requirement 4: Encrypt transmission of cardholder data across open, public networks PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 4.1 Are strong cryptography and security protocols, such as TLS, SSH or IPSEC, used to safeguard sensitive cardholder data during transmission over open, public networks? Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Radio Service (GPRS). Note: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Review documented standards Review policies and procedures Review all locations where CHD is transmitted or received Examine system configurations Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations