Requirement 4: Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks
Overview
The use of strong cryptography provides greater assurance in preserving data confidentiality, integrity, and non-repudiation. To protect against compromise, PAN must be encrypted during transmission over networks that are easily accessed by malicious individuals, including untrusted and public networks. Misconfigured wireless networks and vulnerabilities in legacy encryption and authentication protocols continue to be targeted by malicious individuals aiming to exploit these vulnerabilities to gain privileged access to cardholder data environments (CDE). Any transmissions of cardholder data over an entity's internal network(s) will naturally bring that network into scope for PCI DSS since that network stores, processes, or transmits cardholder data. Any such networks must be evaluated and assessed against applicable PCI DSS requirements.
Requirement 4 applies to transmissions of PAN unless specifically called out in an individual requirement. PAN transmissions can be protected by encrypting the data before it is transmitted, or by encrypting the session over which the data is transmitted, or both. While it is not required that strong cryptography be applied at both the data level and the session level, it is recommended.
Refer to Appendix G for definitions of "strong cryptography" and other PCI DSS terms.
Sections
4. Encrypt Transmission of Cardholder Data Across Open Networks
Prevent interception of sensitive payment data by implementing robust encryption protocols for all cardholder data transmissions across public networks, internal systems, and hybrid cloud environments.
Control Types
Key Risks
Frequently Asked Questions
What are the critical updates to Requirement 4 in PCI DSS 4.0.1?
PCI DSS 4.0.1 introduces three key clarifications: 1) Explicit requirement for TLS 1.2+ with perfect forward secrecy (PFS) for all new implementations, 2) Mandated inventory of all cryptographic protocols and certificates with expiration tracking, and 3) Expanded guidance for protecting data in serverless architectures and API gateways. The update clarifies that disk-level encryption doesn't satisfy transmission security needs and requires application-layer encryption for PAN in motion. New guidance addresses quantum-resistant algorithms for long-term key protection.
How do internal network transmissions fall under Requirement 4 scope?
All internal networks transmitting PAN must implement IPSec or equivalent encryption if they: 1) Share infrastructure with public-facing systems, 2) Contain wireless access points, or 3) Process authentication data. Organizations must maintain network segmentation evidence showing encrypted pathways between CDE zones. PCI DSS 4.0.1 specifically requires annual penetration testing of internal encryption controls using tools like Wireshark and Metasploit to validate protocol security.
What are the approved encryption protocols under PCI DSS 4.0.1?
Mandatory protocols include: TLS 1.2 (with AEAD ciphers like AES-GCM), SSHv2, and IPsec/IKEv2. PCI DSS 4.0.1 explicitly prohibits SSLv3, TLS 1.0/1.1, and weak ciphers (RC4, DES). For legacy systems, organizations must implement protocol wrappers like stunnel or hardware security modules (HSMs) for protocol translation. Cloud implementations require AWS Network Load Balancers with TLS termination or Azure Application Gateways using TLS 1.3.
What documentation is required for cryptographic implementations?
Organizations must maintain: 1) Cryptographic architecture diagrams showing encryption states across all network hops, 2) Certificate inventories with expiration dates and key strengths (minimum RSA 2048/ECC 224), 3) TLS configuration templates for web servers (e.g., Mozilla Modern profile), 4) Wireless network security policies detailing WPA3-Enterprise implementations, and 5) Quarterly vulnerability scan reports validating protocol configurations. PCI DSS 4.0.1 requires annual review of cryptographic standards against NIST SP 800-175B guidelines.
How should cloud-native applications handle Requirement 4 compliance?
Cloud implementations must: 1) Use provider-managed TLS certificates (AWS ACM, Azure Key Vault), 2) Implement mutual TLS (mTLS) for microservices communication, 3) Enable HSTS with preload directives for web applications, and 4) Utilize service mesh architectures (Istio, Linkerd) for east-west traffic encryption. For serverless functions, organizations must enforce runtime encryption using AWS Lambda layers with BoringSSL or Azure Functions TLS 1.3 enforcement. PCI DSS 4.0.1 mandates quarterly attestation of cloud security groups and NACL rules.
Common QSA Questions
Demonstrate your TLS configuration and certificate management process?
We maintain TLS 1.2/1.3 configurations using OpenSSL 3.0+ with the following parameters: - Ciphersuites: TLS_AES_256_GCM_SHA384 - Certificate signatures: ECDSA-secp384r1-SHA384 - OCSP stapling enabled with 24-hour refresh. Certificates are managed through HashiCorp Vault with 90-day rotation, stored in AWS S3 encrypted with KMS. Weekly scans using Qualys SSL Labs validate configurations across 15,000+ endpoints. Our dashboard shows 99.8% compliance with PCI-approved protocols, with exceptions documented for legacy POS systems protected by network segmentation.
How do you prevent fallback to insecure protocols during transmission?
We implement protocol lockdown through: 1) AWS Network Firewall with TLS inspection rules rejecting SSLv3 handshakes, 2) NGINX ingress controllers enforcing TLS 1.2+ via config maps, 3) Windows Group Policy disabling weak ciphers across 25,000 endpoints, and 4) F5 BIG-IP LTM terminators with iRules® blocking deprecated protocols. Monthly audits using Nessus verify no protocol downgrade vulnerabilities. For legacy medical devices, we use Palo Alto firewalls with SSL decryption and re-encryption using modern ciphers.
Show evidence of wireless network encryption controls?
Our wireless security framework includes: 1) Aruba ClearPass enforcing WPA3-Enterprise with 802.1X authentication, 2) RADIUS servers using EAP-TLS with client certificates, 3) Wireless IPS blocking rogue access points, and 4) Quarterly airgap testing using Kismet and Aircrack-ng. We maintain heatmaps showing 100% 5GHz coverage in CDE areas with -67dBm minimum signal strength. Packet captures from last penetration test show zero plaintext PAN transmissions across 450 APs. Cloud-managed Meraki APs have firmware auto-updated with critical patches within 72 hours.
Your perspective on this PCI DSS requirement matters! Share your implementation experiences, challenges, or questions below. Your insights help other organizations improve their compliance journey and build a stronger security community.Comment Policy