What evidence do auditors commonly ask for on 4.1.1 Requirement 4 policies and procedures maintained and communicated?

Approved policy on encrypting PAN over open, public networks with version history and owner; Operational procedures for configuring TLS, certificates and secure messaging, with last review date; Evidence of distribution or acknowledgement by network, application and messaging administrators; Change log showing the documents were updated after a protocol, certificate or architecture change.

What is the most common gap auditors find on 4.1.1?

Transmission encryption policy exists but was not revised when TLS versions or cipher suites changed

PCI DSS v4.0.1 · Req 4: Protect Cardholder Data in Transit

`4.1.1` Requirement 4 policies and procedures maintained and communicated

The organisation must hold security policies and operational procedures covering every activity named in Requirement 4 (encryption of PAN while it travels over open, public networks), and each of them must be: written down; reviewed and refreshed so they stay current; actually followed in practice; and communicated to everyone they affect. Updates should follow changes in process, technology or business objectives rather than wait for a scheduled cycle. Applicability: applies to every entity in scope, with no special notes. Customized approach objective: people involved in Requirement 4 work know what is expected of them and follow it, so the supporting activities run the same way each time and match what management intends.

Source: PCI DSS v4.0.1, 4.1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.

artefacts

held by a system

at each review

moderate

to go live

SIEM / log platform

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Change log showing the documents were updated after a protocol, certificate or architecture change · SIEM / log platform

periodic reviewEvidence produced at each review

Evidence of distribution or acknowledgement by network, application and messaging administrators · HR system / LMS

governing documentDocuments that govern the control

Approved policy on encrypting PAN over open, public networks with version history and owner · Policy repository / GRC workspace
Operational procedures for configuring TLS, certificates and secure messaging, with last review date · Policy repository / GRC workspace

First move

Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Transmission encryption policy exists but was not revised when TLS versions or cipher suites changed
Procedures sit on a shared drive that operations staff interviewed do not know about
Written procedure describes a gateway or protocol that is no longer in use

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

3.7.9 Key guidance for service provider customers · 4.1.2 Requirement 4 roles and responsibilities assigned