The PCI DSS requirementRequirement 4.1 states "usethat strong cryptography and security protocols such as SSL / TLS/ IPSECmust be used to safeguard sensitive cardholder data during transmission over open, public networks. ? While the PCI DSS does not specifically mention Bluetooth technology as an open, public network, it is a technology that can present security risk if not implemented properly. Appropriate measures in the implementation of the Bluetooth technology must be taken such as having the security features enabled and using long PIN codes or pairing the devices only in private. PCI SSC recommends that you consult a Qualified Security Assessor for proper implementation of the Bluetooth technology. Our list of Qualified Security Assessors can be found at: https://www.pcisecuritystandards.org/resources/qualified_security_assessors.htm Please note: If a vendor is providing an application that is facilitating the transmission of the cardholder transaction using Bluetooth technology, that vendor is responsible for meeting the PCI DSS requirements, not the consumerBluetooth technology is included in Requirement 4.1 as an example of an open, public network, and cardholder data sent over Bluetooth must therefore be protected in accordance with this requirement. If a Bluetooth implementation is unable to meet strong cryptography,
compensating controls will need to be implemented to prevent unauthorized access to Bluetooth transmissions to capture cardholder data.
