PCI DSS 4.2.1.1: An inventory of the entity’s trusted keys and certificates used to protect PAN during
PCI DSS v4.0.1 control 4.2.1.1: the requirement in full, the 2 testing procedures an assessor uses to verify it, and the related controls in section 4.2.
Requirement 4: Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks › Section 4.2
An inventory of the entity’s trusted keys and certificates used to protect PAN during transmission is maintained.
Summary
Keep a current inventory of the keys and certificates that protect card numbers in transit.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 4.2.1.1.a | Examine documented policies and procedures to verify processes are defined for the entity to maintain an inventory of its trusted keys and certificates. |
| 4.2.1.1.b | Examine the inventory of trusted keys and certificates to verify it is kept up to date. |
Read the phrase carefully before scoping it: trusted keys and certificates, which is broader than "the certificates our servers present". The fuller reading takes in the trust anchors you rely on as well, meaning the certificate authorities your systems accept when validating the other end. Decide which reading you are evidencing and be able to defend it, because an inventory of your own server certificates is a defensible half and it is only half. Procedure 4.2.1.1.b examines that the inventory is kept up to date, so this is a maintenance obligation rather than a document, and the practical value is the same thing the control is testing: knowing what expires when, before it does.
What to prepare
- The documented process for maintaining the inventory, which 4.2.1.1.a asks for separately from the inventory itself.
- The inventory: certificate, where it is installed, what it protects, issuer, expiry, owner.
- The trust anchors your systems accept, if that is the reading you are evidencing.
- Evidence it is current, such as its last update against a recent certificate change.
How to implement it
1. Generate it rather than maintaining it. Certificates are discoverable from the endpoints that serve them, and a generated inventory is current by construction where a spreadsheet is current on the day it was written.
2. Record the owner, not just the certificate. Expiry is the failure this inventory prevents, and an expiry with no owner is a discovery rather than a warning.
3. Include the ones you did not issue. Load balancers, CDNs, payment gateway connections and vendor endpoints all carry certificates that protect PAN in transit and are usually outside the internal certificate process.
4. Prune the trust store deliberately. If you take the wider reading, the list of certificate authorities your systems trust is part of this, and most default trust stores contain far more than any one environment needs.
Where this commonly fails
- An inventory of internally issued certificates only, missing everything terminated at a CDN or a vendor.
- A spreadsheet updated for the assessment, which fails the "kept up to date" element the procedure names.
- No documented process behind it, which fails 4.2.1.1.a while the inventory itself passes 4.2.1.1.b.
- Expiry recorded and unowned, so the inventory documents outages rather than preventing them.
Related controls
Others in section 4.2:
| Control | What it requires |
|---|---|
| 4.2.1 | Strong cryptography and security protocols… |
| 4.2.1.2 | Wireless networks transmitting PAN or connected to the CDE use industry best practices… |
| 4.2.2 | PAN is secured with strong cryptography whenever it is sent via end-user messaging technologies |
← 4.2.1 · All controls · 4.2.1.2 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.