(b) Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates (c) Are security protocols implemented to use only secure Examine system configurations configurations, and to not support insecure versions or configurations? Is the proper encryption strength implemented for the Review vendor documentation encryption methodology in use (check vendor Examine system configurations recommendations/best practices)? For TLS implementations, is TLS enabled whenever Examine system configurations cardholder data is transmitted or received? For example, for browser-based implementations: appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if appears “HTTPS” as part of the URL. 4.1.1 Are industry best practices used to implement strong Review documented standards encryption for authentication and transmission for wireless Review wireless networks networks transmitting cardholder data or connected to the Examine system configuration cardholder data environment? settings (b) Are policies in place that state that unprotected PANs 4.2 Review policies and procedures are not to be sent via end-user messaging technologies? Maintain a Vulnerability Management Program
(b) Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates (c) Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations For TLS implementations, is TLS enabled whenever cardholder data is transmitted or received? For example, for browser-based implementations: appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if “HTTPS” appears as part of the URL. Examine system configurations 4.1.1 Are industry best practices used to implement strong encryption for authentication and transmission for wireless networks transmitting cardholder data or connected to the cardholder data environment? Review documented standards Review wireless networks Examine system configuration settings 4.2 (b) Are policies in place that state that unprotected PANs are not to be sent via end-user messaging technologies? Review policies and procedures Maintain a Vulnerability Management Program
pci-dss-v3_2-saq-c-rev1_1.docx