Which PCI DSS requirement covers encrypting transmission of cardholder data across open, public networks?

Which PCI DSS requirement covers encrypting transmission of cardholder data across open, public networks?

• A. Restrict physical access to cardholder data
• B. Identify and authenticate access to system components
• C. Track and monitor all access to network resources and cardholder data
• D. Encrypt transmission of cardholder data across open, public networks

Answer: (D)

Protecting data as it moves across networks is essential because open, public networks can be intercepted by attackers. Encrypting cardholder data during transmission ensures that even if the data is captured, it remains unreadable without the proper cryptographic keys. PCI DSS explicitly requires this for data in transit: use strong cryptography and robust key management to encrypt cardholder data when it travels over open networks. This safeguards confidentiality during transmission and mitigates the risk of eavesdropping or tampering as data crosses the boundary into or out of the organization’s control. The other protections address different risk areas: physical security of devices and media, controls that identify and authenticate who can access systems, and logging/monitoring of access and activity. While important, they don’t specifically mandate encryption of data in transit, which is why encryption of transmission across open networks is the correct focus for this requirement.

Protecting data as it moves across networks is essential because open, public networks can be intercepted by attackers. Encrypting cardholder data during transmission ensures that even if the data is captured, it remains unreadable without the proper cryptographic keys. PCI DSS explicitly requires this for data in transit: use strong cryptography and robust key management to encrypt cardholder data when it travels over open networks. This safeguards confidentiality during transmission and mitigates the risk of eavesdropping or tampering as data crosses the boundary into or out of the organization’s control.

The other protections address different risk areas: physical security of devices and media, controls that identify and authenticate who can access systems, and logging/monitoring of access and activity. While important, they don’t specifically mandate encryption of data in transit, which is why encryption of transmission across open networks is the correct focus for this requirement.