Is the proper encryption strength implemented for the Review vendor documentation encryption methodology in use (check vendor Examine system configurations recommendations/best practices)? [Fill out per your OST-approved 3rd party vendor.] For TLS implementations, is TLS enabled whenever Examine system configurations cardholder data is transmitted or received? [Fill out per your OST-approved 3rd For example, for browser-based implementations: party vendor.] appears as the browser Universal Record “HTTPS” Locator (URL) protocol, and Cardholder data is only requested if appears “HTTPS” as part of the URL. For POS POI terminals (and the SSL/TLS termination Review documentation that verifies points to they connect) using SSL and/or early POS POI devices are not TLS and for which the entity asserts are not susceptible to any exploits for susceptible to any known exploits for those protocols: SSL/early TLS Is there documentation (for example, vendor [Fill out per your OST-approved 3rd documentation, system/network configuration details, vendor.] etc.) that verifies the devices are not susceptible to any known exploits for SSL/early TLS?
Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations [Fill out per your OST-approved 3rd party vendor.] For TLS implementations, is TLS enabled whenever cardholder data is transmitted or received? For example, for browser-based implementations: “HTTPS” appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if “HTTPS” appears as part of the URL. Examine system configurations [Fill out per your OST-approved 3rd party vendor.] For POS POI terminals (and the SSL/TLS termination points to they connect) using SSL and/or early TLS and for which the entity asserts are not susceptible to any known exploits for those protocols: Is there documentation (for example, vendor documentation, system/network configuration details, etc.) that verifies the devices are not susceptible to any known exploits for SSL/early TLS? Review documentation that verifies POS POI devices are not susceptible to any exploits for SSL/early TLS [Fill out per your OST-approved 3rd vendor.]