Requirement 4.2 is a strange one actually.
It mandates that any PANs,
any primary account numbers which are transmitted over
messaging services such as email, chat, Instant Messenger apps such as,
I don't know What's App or SMS, have to be encrypted.
Let's be clear.
This isn't a requirement that says organizations cannot use
messaging technologies to send and receive PANs,
and remember the PAN is the primary account number,
that 15- or 16-digit number on the card.
It's just that if they do want to use messaging services to transmit PANs,
but just that they need to ensure and not assume that the messages
encrypted are either the transport layer or by encrypting the
message itself before it's transmitted.
Look,
it's really also worth looking at that guidance
paragraph I've highlighted in blue,
which is that if your organization or an organization
solicits cardholder data by messaging service,
then the organization needs to make sure the PAN is
encrypted throughout the whole transmission.
The QSA is going to look at policies,
and here we're also going to probably look at your end-user focused policies.
Some people call these acceptable use policies,
to make sure that people in the organization know the rules about
sending cardholder data over messaging technology,
and especially email,
and if the organization does send or accept PANs over messaging technologies,
the QSA is also going to look at how these are configured.
They will watch the people using the messaging technology,
and what they're looking for there is to see if the people are
using any tools provided to protect PANs,
and the QSA will also look at actual data transmissions.