PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 4 / c4.2
Foundational Data ProtectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c4.2 Inventory and validate certificates and connection trust

Maintain an inventory of trusted certificates and ensure that the keys and certificates used to protect PAN in transit are valid, current, and trusted.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: Medium Applies to CDE: Yes

Requirement 4

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

4.2 PAN is protected with strong cryptography during transmission
  • 4.2.1 Strong cryptography and security protocols protect PAN in transit Covered
  • 4.2.1.1 Inventory of trusted keys and certificates maintained Covered
  • 4.2.1.2 Wireless networks transmitting PAN use strong cryptography Covered
  • 4.2.2 PAN secured with strong cryptography when sent via end-user messaging Roadmap

How to implement on AWS

Centralize issuance with ACM and ACM Private CA for internal connections. Monitor certificate expiration with EventBridge/Config. Maintain an inventory of certificates and their uses. Enforce certificate validation on clients that transmit PAN.

Practical implementation

How this control is implemented in each reference architecture:

Keep every certificate that protects PAN in transit valid, trusted, and inventoried, and get alerted before anything expires.

  1. Issue public certificates with ACM and internal-connection certificates with ACM Private CA, so issuance and renewal are managed, not manual.
    Account PKI Certificate Manager AWS Private CA
  2. Maintain an inventory of trusted certificates and their uses (the artifact PCI 4.2.1.1 requires).
    Certificate inventory Certificate Manager
  3. Monitor certificate expiry with the AWS Config managed rule and EventBridge notifications so renewals never lapse.
    Account-wide detection AWS Config EventBridge

How to validate: The certificate inventory is current and matches ACM/Private CA, and an expiry-approaching test triggers the EventBridge alert.

Avoid: Importing self-managed certificates and tracking expiry in a spreadsheet. Use ACM-managed certs so renewal is automatic and the inventory is authoritative.

Single-account, 3-tier →

Run one internal CA hierarchy centrally, share it to CDE accounts, and consolidate the certificate inventory across the org.

  1. Operate ACM Private CA centrally (network or security account) as the single trusted internal root/intermediate hierarchy.
    Network/inspection account AWS Private CA
  2. Share the CA to CDE accounts (AWS RAM) so every account issues from the same trust chain.
    Network account → PCI OU AWS Private CA AWS RAM
  3. Consolidate the certificate inventory and expiry monitoring centrally (Config aggregator + EventBridge).
    Security tooling account AWS Config EventBridge AWS Organizations

How to validate: CDE accounts issue certs from the shared Private CA, and the central inventory lists every certificate with validity dates.

Avoid: A separate internal CA per account. Multiple roots fragment trust and inventory; centralize the CA and share it.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examine

Testing procedures

  • Examine policies and procedures to verify a process is defined to maintain an inventory of trusted keys and certificates (4.2.1.1.a).
  • Examine the inventory of trusted keys and certificates to verify it is kept up to date (4.2.1.1.b).

Evidence in AWS

  • ACM/Private CA certificate inventory with validity dates.
  • Expiration alerts configured (EventBridge/Config).
  • Certificate-validation configuration on services that transmit PAN.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 4.2 — Cleartext PAN cannot be read or intercepted from any transmissions over open, public networks.

AWS services

AWS Certificate Manager AWS Private CA Amazon EventBridge AWS Config

Learning resources

References

  • PCI DSS v4.0.1 Requirement 4.2.1.1