Response one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Are strong cryptography and security protocols, such 4.1 Review documented standards as TLS, SSH or IPSEC, used to safeguard sensitive Review policies and procedures cardholder data during transmission over open, Review all locations where CHD is public networks? transmitted or received Examples of open, public networks include but are not Examine system configurations limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Radio Service (GPRS). Note: SSL and TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only Examine system configurations secure configurations, and to not support insecure versions or configurations? Is the proper encryption strength implemented for the Review vendor documentation encryption methodology in use (check vendor Examine system configurations recommendations/best practices)?
PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 4.1 Are strong cryptography and security protocols, such as TLS, SSH or IPSEC, used to safeguard sensitive cardholder data during transmission over open, public networks? Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Radio Service (GPRS). Note: SSL and TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Review documented standards Review policies and procedures Review all locations where CHD is transmitted or received Examine system configurations Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations
PCI_DSS_v3-1_SAQ_A-EP_rev1-1.docx