I am working at a company that is PCI compliant, but I believe they have interpreted some of the requirements incorrectly. Because of this, they are laboring to create work-arounds which I suspect are not necessary.
Specifically, I am wondering about the definition of "Transmission", in the context of PCI requirement 4.2 b "All secret and confidential data must be encrypted at all times during transmission and storage".
The company has taken this to mean that any time a file is copied WITHIN THE INTERNAL NETWORK, that this constitutes transmission, and because of that the file needs to first be encrypted.
I believe, though, that transmission seems to imply transfer through the internet - where of course you would need to have that encrypted.
Can anyone help settle the argument?