Skip to main content

💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.

Description​

As following:

  • Only trusted keys and certificates are accepted.
  • Certificates used to safeguard PAN during transmission over open, public networks are confirmed as valid and are not expired or revoked. This bullet is a best practice until its effective date; refer to applicability notes below for details.
  • The protocol in use supports only secure versions or configurations and does not support fallback to, or use of insecure versions, algorithms, key sizes, or implementations.
  • The encryption strength is appropriate for the encryption methodology in use.

Similar​

  • Sections
    • /frameworks/pci-dss-v3.2.1/04/01
    • /frameworks/pci-dss-v4.0.1/04/02/01

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 PCI DSS v3.2.1 → 💼 4.1 Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.169
💼 PCI DSS v4.0.1 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.29

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 PCI DSS v3.2.1 → 💼 4.1 Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.169
💼 PCI DSS v4.0.1 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.29

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 4.2.1.1 An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained.
💼 4.2.1.2 Wireless networks transmitting PAN or connected to the CDE use industry best practices to implement strong cryptography for authentication and transmission.

Policies (9)​

PolicyLogic CountFlags
📝 AWS ACM Certificate expires in the next 7 days 🟢1🟢 x6
📝 AWS ACM RSA Certificate key length is less than 2048 bits 🟢1🟢 x6
📝 AWS S3 Bucket Policy is not set to deny HTTP requests 🟢1🟢 x6
📝 Azure App Service FTP deployments are not disabled 🟢1🟢 x6
📝 Azure App Service HTTPS Only configuration is not enabled 🟢1🟢 x6
📝 Azure MySQL Flexible Server require_secure_transport Parameter is not set to ON 🟢1🟢 x6
📝 Azure PostgreSQL Flexible Server require_secure_transport Parameter is not set to ON 🟢1🟢 x6
📝 Azure PostgreSQL Single Server Enforce SSL Connection is not set enabled 🟢1🟢 x6
📝 Azure Storage Account Secure Transfer Required is not enabled 🟢1🟢 x6