View source for PCI-4.1.1:

<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
<br>
::'''Use strong cryptography and encryption techniques (at least 128 bit) such as Secure Sockets Layer (SSL), Point-to-Point Tunneling Protocol (PPTP), Internet Protocol Security (IPSEC) to safeguard sensitive cardholder data during transmission over public networks.'''<br>
<br>
:::'''Verify the use of encryption (e.g., SSL) wherever cardholder data is transmitted or received over the Internet by performing the following:'''<br>
<br>
:::* Verify that at least 128 bit encryption is used during data transmission.
:::* For SSL implementations, verify that HTTPS appears as a part of the browser Universal Record Locator (URL), and that no cardholder data was required when HTTPS did not appear in the URL.
:::* Select a sample of transactions as they are received and observe transactions as they occur to verify that cardholder data is encrypted during transit.
:::* Verify that only trusted SSL keys/certificates are accepted.<br>
<br>
:::'''Verify that, for the encryption methodology in use, the proper encryption strength is implemented. For example:'''<br>
<br>
:::* 3DES: 128 bits
:::* AES: 256 bits
:::* RSA: 1024 bits
:::* Check vendor recommendations and best practices for other encryption methodologies.
<br>
::::'''PCI-4.1.1:''' For wireless networks transmitting cardholder data or connected to cardholder environments, verify that:<br>
<br>
::::* Appropriate encryption methodologies are in use for any wireless transmissions, such as: VPN, SSL/TLS at 128 bit, WEP (Wired Equivalency Protocol) at 128 bits, and/or WPA.
::::* If WEP is used, verify processes are in place to rotate shared WEP keys at least quarterly and whenever key personnel leave.
::::* If WEP is used, verify that another methodology is in use, in addition to WEP, to protect the data.
::::* For automated key rotation processes, verify that keys change every 10-30 minutes.
<br>
</blockquote>
<br>
'''Testing Procedures'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Insert testing guidance here.
</blockquote>
'''Testing Frequency'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Describe testing frequency here.
<br>
</blockquote>

'''Evidence Archive Location'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Insert hyperlink or location of evidence archive.
<br>
</blockquote>

'''Control Stewards Process Narrative'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<p><font color=#008000>Provide control steward commentary indicating the formal methodology in place.</font></p>

<br>
'''Control Steward – Jon Doe'''
<br>
</blockquote>

'''Process Illustration'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.
<br>
</blockquote>

'''Control Status and Auditors Commentary'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<p><font color=#008000>The control is effective.</font></p>
<br>
[[Image:greenlock.jpg]]<br>
<br>
Status is acceptable.
<br>
</blockquote>

'''Control Exception Commentary'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Status is acceptable.
<br>
</blockquote>

'''Remediation Plan'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Remediation is not required at this time.
<br>
</blockquote>
<br>

--[[User:Mdpeters|Mdpeters]] 12:46, 28 February 2007 (EST)