Are strong cryptography and security protocols, 4.1 Review documented standards such as SSL/TLS, SSH or IPSEC, used to Review policies and procedures safeguard sensitive cardholder data during Review all locations where CHD is transmission over open, public networks? transmitted or received Examples of open, public networks include but are not Examine system configurations limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Service (GPRS). Are only trusted keys and/or certificates Observe inbound and outbound accepted? transmissions Examine keys and certificates Are security protocols implemented to use only Examine system configurations secure configurations, and to not support insecure versions or configurations? Is the proper encryption strength implemented for Review vendor documentation the encryption methodology in use (check vendor Examine system configurations recommendations/best practices)? For SSL/TLS implementations, is SSL/TLS Examine system configurations enabled whenever cardholder data is transmitted or received? For example, for implementations: appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if “HTTPS” appears as part of the URL. (b) Are policies in place that state that unprotected 4.2 Review policies and procedures PANs are not to be sent via end-user messaging technologies? Maintain a Vulnerability Management Program
4.1 Are strong cryptography and security protocols, such as SSL/TLS, SSH or IPSEC, used to safeguard sensitive cardholder data during transmission over open, public networks? Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Service (GPRS). Review documented standards Review policies and procedures Review all locations where CHD is transmitted or received Examine system configurations Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations For SSL/TLS implementations, is SSL/TLS enabled whenever cardholder data is transmitted or received? For example, for implementations: appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if “HTTPS” appears as part of the URL. Examine system configurations 4.2 (b) Are policies in place that state that unprotected PANs are not to be sent via end-user messaging technologies? Review policies and procedures Maintain a Vulnerability Management Program
SAQ_A-EP_v3.docx