Before I arrived at my current company we obtained the services of PCI consultant who gave us some very specific, if questionable, advice on encryption requirements.
The particular piece of advice I am suspicious of is that of making sure that cardholder data is encrypted as is moves across our internal (detached) network. The method of encryption, we were told, needs to be at the Application level, and Transport level is not allowed. So, instead simply using HTTPS to move a file, we are having to encrypt the file using PGP before sending, then decrypting after it arrives.
I simply can't see in the documentation where this is a requirement. Has anyone else been told the same thing? Is there a precedence for this?
The document we are using is the May 2013 Card Production Logical Specs