PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 4 / c4.3
Efficient Security AssuranceSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c4.3 Continuous monitoring of in-transit encryption posture

Automatically detect any endpoint or connection that transmits data without strong encryption and remediate consistently to sustain continuous compliance.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: Medium Applies to CDE: Yes

Requirement 4

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

4.2 PAN is protected with strong cryptography during transmission
  • 4.2.1 Strong cryptography and security protocols protect PAN in transit Covered
  • 4.2.1.1 Inventory of trusted keys and certificates maintained Covered
  • 4.2.1.2 Wireless networks transmitting PAN use strong cryptography Covered
  • 4.2.2 PAN secured with strong cryptography when sent via end-user messaging Roadmap

How to implement on AWS

Define AWS Config rules (alb-http-to-https-redirection-check, elb-tls-https-listeners-only, cloudfront-viewer-policy-https) and consolidate in Security Hub. Automate remediation with SSM Automation. Alert on deviations via EventBridge and Security Hub.

Practical implementation

How this control is implemented in each reference architecture:

Reach the optimized state: continuously detect any endpoint transmitting without strong TLS and auto-remediate it, so in-transit posture stays compliant on its own.

  1. Enable the AWS Config HTTPS/TLS managed rules (alb-http-to-https-redirection-check, elb-tls-https-listeners-only, cloudfront-viewer-policy-https) in the account.
    Account-wide detection AWS Config
  2. Attach auto-remediation (SSM Automation) so a non-compliant or plaintext listener is corrected automatically.
    Account automation Systems Manager
  3. Alert on drift through EventBridge and consolidate the posture in Security Hub.
    Account-wide detection EventBridge Security Hub

How to validate: The HTTPS/TLS Config rules read COMPLIANT with remediation history, and a test HTTP-only listener is auto-corrected within minutes.

Avoid: Alerting on non-HTTPS listeners without remediating. The plaintext window stays open until someone acts; wire SSM Automation to close it automatically.

Single-account, 3-tier →

Monitor and enforce in-transit encryption uniformly across every CDE account from one place.

  1. Deploy the HTTPS/TLS Config rules org-wide via a conformance pack so every CDE account is evaluated identically.
    PCI OU (all CDE accounts) AWS Config AWS Organizations
  2. Aggregate results in the delegated-admin Security Hub for a single in-transit posture view.
    Security tooling account Security Hub
  3. Drive automated remediation centrally (EventBridge + SSM Automation) so every account self-corrects the same way.
    Security tooling account EventBridge Systems Manager

How to validate: The conformance pack shows HTTPS/TLS rules COMPLIANT org-wide, and a planted HTTP listener in any CDE account is auto-remediated and visible in Security Hub.

Avoid: Per-account monitoring with no central rollup. Aggregate to the delegated admin so one dashboard proves in-transit compliance across the estate.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine system configurations and monitoring evidence to verify strong cryptography and security protocols remain implemented across all PAN transmissions over open, public networks (4.2.1.b, 4.2.1.c).

Evidence in AWS

  • AWS Config HTTPS/TLS rules in COMPLIANT state.
  • Security Hub dashboard with in-transit encryption controls.
  • History of automatic remediation of non-compliant listeners.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 4.2 — Cleartext PAN cannot be read or intercepted from any transmissions over open, public networks.

AWS services

AWS Config AWS Security Hub AWS Systems Manager Automation Amazon EventBridge

Learning resources

References

  • AWS Security Maturity Model: Continuous compliance monitoring