3.3 Is the PAN masked when displayed (the first six and Review policies and procedures last four digits are the maximum number of digits to be Review roles that need access to displayed) such that only personnel with a legitimate displays of full PAN business need can see more than the first six/last four Examine system configurations digits of the PAN? Observe displays of PAN Note: This requirement does not supersede stricter requirements in place for displays of cardholder example, legal or payment card brand requirements for point-of-sale (POS) receipts. Requirement 4: Encrypt transmission of cardholder data across open, public networks Response one response for each PCI DSS Question Expected Testing question) Yes with Yes CCW No N/A (a) Are strong cryptography and security protocols used to 4.1 Review documented standards safeguard sensitive cardholder data during transmission Review policies and procedures over open, public networks? Review all locations CHD is Note: Where SSL/early TLS is used, the requirements in transmitted or received Appendix A2 must be completed. Examine system configurations Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Service (GPRS). (b) Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates
3.3 Is the PAN masked when displayed (the first six and last four digits are the maximum number of digits to be displayed) such that only personnel with a legitimate business need can see more than the first six/last four digits of the PAN? Note: This requirement does not supersede stricter requirements in place for displays of cardholder example, legal or payment card brand requirements for point-of-sale (POS) receipts. Review policies and procedures Review roles that need access to displays of full PAN Examine system configurations Observe displays of PAN Requirement 4: Encrypt transmission of cardholder data across open, public networks PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 4.1 (a) Are strong cryptography and security protocols used to safeguard sensitive cardholder data during transmission over open, public networks? Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Service (GPRS). Review documented standards Review policies and procedures Review all locations CHD is transmitted or received Examine system configurations (b) Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates
PCI-DSS-v3_2-SAQ-C_VT-rev1_1.docx