Which policy is required regarding PAN transmission via end-user messaging technologies?

• A. A policy stating that unprotected PANs are not to be sent via end-user messaging technologies.
• B. A policy allowing PANs to be transmitted unencrypted if the message is short.
• C. A policy requiring PANs to be transmitted only by email.
• D. A policy that PANs should never be generated.

Answer: (A)

Transmitting the PAN through end-user messaging tools is risky because those channels don’t provide reliable, PCI-compliant protection in transit. PCI DSS guidance emphasizes that cardholder data should not be sent over end-user messaging technologies in unprotected form, since interception, eavesdropping, or unauthorized access is more likely on those platforms. The correct policy, therefore, is to prohibit sending unprotected PANs via these channels, reducing the chance of exposure and aligning with the requirement to protect cardholder data during transmission. Policies that allow unencrypted transmission, restrict transmission to a single method, or suggest never generating PANs do not address the core risk of insecure in-transit handling.