Requirement 4: Encrypt transmission of cardholder data across open, public networks Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Not Yes CCW No N/A Tested (a) Are strong cryptography and security protocols used to 4.1 Review documented standards safeguard sensitive cardholder data during transmission Review policies and over open, public networks? procedures Note: SSL/early TLS is used, the requirements in Review all locations where Appendix A2 must be completed. CHD is transmitted or received Examples of open, public networks include but are not limited Examine system to the Internet; wireless technologies, including 802.11 and configurations Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Radio Service (GPRS). (b) Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates (c) Are security protocols implemented to use only secure Examine system configurations, and to not support insecure versions or configurations configurations? Is the proper encryption strength implemented for the Review vendor documentation encryption methodology in use (check vendor Examine system recommendations/best practices)? configurations For TLS implementations, is TLS enabled whenever Examine system cardholder data is transmitted or received? configurations For example, for browser-based implementations: appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if appears as part of the URL.
Requirement 4: Encrypt transmission of cardholder data across open, public networks PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 4.1 (a) Are strong cryptography and security protocols used to safeguard sensitive cardholder data during transmission over open, public networks? Note: SSL/early TLS is used, the requirements in Appendix A2 must be completed. Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Radio Service (GPRS). Review documented standards Review policies and procedures Review all locations where CHD is transmitted or received Examine system configurations (b) Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates (c) Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations For TLS implementations, is TLS enabled whenever cardholder data is transmitted or received? For example, for browser-based implementations: appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if appears as part of the URL. Examine system configurations