PCI DSS Requirement 4: Encrypting Cardholder Data in Transit

Requirement 4 Structure

Deep Dives

• 4.2.1 - Strong cryptography and security protocols for PAN on open, public networks: only trusted keys/certificates; certificates valid and not expired or revoked; protocol supports only secure versions (no insecure fallback); encryption strength appropriate to the method.
• 4.2.1.1 - Maintain an inventory of trusted keys and certificates used to protect PAN in transit (mandatory since 31 March 2025).
• 4.2.1.2 - Wireless networks transmitting PAN or connected to the CDE use industry best practices for strong crypto for authentication and transmission.
• 4.2.2 - Secure PAN with strong cryptography when sent via end-user messaging technologies.

Certificate validity/revocation checks in 4.2.1 and the inventory in 4.2.1.1 were best practice until 31 March 2025 and are now required.

How CyberSilo Helps

• Compliance Standards Automation - certificate and TLS posture evidence
• Threat Exposure Management - surface weak protocol exposure on Internet-facing paths

Frequently Asked Questions

Are TLS 1.0 and 1.1 acceptable?

No. 4.2.1 requires protocols that support only secure versions/configurations and do not fall back to insecure versions, algorithms, key sizes, or implementations.

Do self-signed certificates work?

Self-signed certs where issued-by and issued-to Distinguished Names match are not acceptable. An internal CA-issued certificate can be acceptable if authorship is confirmed, the cert is verified (for example hash/signature), and it has not expired.

What about PAN sent by email or chat?

4.2.2 requires strong cryptography whenever PAN is sent via end-user messaging technologies - including when a customer asks for it that way.

Related PCI Resources

PCI DSS hub · PCI DSS v4.0.1: What Changed · USA v4.0.1 services