What it asks for. Organisations must protect primary account numbers with strong cryptography whenever they are sent over open, public networks, such as the internet, wireless and cellular links. Only trusted keys and certificates may be used, and PAN must not be sent through unprotected end-user messaging.
In practice. Doing this well means using current secure protocol versions and cipher suites, rejecting insecure fallbacks, and validating that certificates are valid and trusted. An inventory of trusted keys and certificates is maintained so expiry and weak algorithms are caught. Policies and technical controls stop PAN being sent by email, chat or similar channels without protection. An assessor will expect protocol configuration evidence, scan results, the certificate inventory and data flow diagrams showing where PAN crosses public networks.
Common gaps. Common gaps are outdated protocols kept for legacy partners, expired or self-signed certificates, and incomplete knowledge of where PAN is transmitted. Customer service channels such as chat and email are often overlooked.