4.2.1PAN is protected with strong cryptography during transmission

Defined Approach Requirements:

Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks:

- Only trusted keys and certificates are accepted.

- Certificates used to safeguard PAN during transmission over open, public networks are confirmed as valid and are not expired or revoked. This bullet is a best practice until its effective date; refer to applicability notes below for details.

- The protocol in use supports only secure versions or configurations and does not support fallback to, or use of insecure versions, algorithms, key sizes, or implementations.

- The encryption strength is appropriate for the encryption methodology in use.

Defined Approach Testing Procedures:

4.2.1.a Examine documented policies and procedures and interview personnel to verify processes are defined to include all elements specified in this requirement.

4.2.1.b Examine system configurations to verify that strong cryptography and security protocols are implemented in accordance with all elements specified in this requirement.

4.2.1.c Examine cardholder data transmissions to verify that all PAN is encrypted with strong cryptography when it is transmitted over open, public networks.

4.2.1.d Examine system configurations to verify that keys and/or certificates that cannot be verified as trusted are rejected.