PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 4.1 Are strong cryptography and security protocols, such as TLS, SSH or IPSEC, used to safeguard sensitive cardholder data during transmission over open, public networks? Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Radio Service (GPRS). Note: SSL and TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Review documented standards Review policies and procedures Review all locations where CHD is transmitted or received Examine system configurations Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations
4.2 (b) Are policies in that state that unprotected PANs are not to be sent via end-user messaging technologies? Review policies and procedures Maintain a Vulnerability Management Program Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 5.1 Is anti-virus software deployed on all systems commonly affected by malicious software? Examine system configurations 5.1.1 Are anti-virus programs capable of detecting, removing, and protecting against all known types of malicious software (for example, viruses, Trojans, worms, spyware, adware, and rootkits)? Review vendor documentation Examine system configurations 5.1.2 Are periodic evaluations performed to identify and evaluate evolving malware threats in to confirm whether those systems considered to not be commonly affected by malicious software continue as such? Interview personnel 5.2 Are all anti-virus mechanisms maintained as follows: Are all software and definitions kept current? Examine policies and procedures Examine anti-virus configurations, including the master installation Examine system components Are automatic updates and periodic scans enabled and being performed? Examine anti-virus configurations, including the master installation Examine system components
Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 9.1 Are appropriate facility entry controls in place to limit and monitor physical access to systems in the cardholder data environment? Observe physical access controls Observe personnel 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, “media” refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing Interview personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for media classification Interview security personnel 9.6.2 Is media sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.8 Is all destroyed when it is no longer needed for business or legal reasons? Review periodic media destruction policies and procedures (c) Is media destruction performed as follows:
9.8.1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Review periodic media destruction policies and procedures Interview personnel Observe processes Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents? Examine security of storage containers Regularly Monitor and Test Networks Requirement 10: Track and monitor all access to network resources and cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 10.2 Are automated audit trails implemented for all system components to reconstruct the following events: 10.2.2 All actions taken by any individual with root or administrative privileges? Interview personnel Observe audit logs Examine audit log settings 10.2.4 Invalid logical access attempts? Interview personnel Observe audit logs Examine audit log settings
Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers This appendix is not used for merchant assessments. Appendix B: Compensating Controls Worksheet Use this worksheet to define compensating controls for any requirement where “YES with CCW” was checked. Note: Only companies that have undertaken a risk analysis and have legitimate technological or documented business constraints can consider the use of compensating controls to achieve compliance. Refer to Appendices B, C, and D of PCI DSS for information about compensating controls and guidance on how to complete this worksheet. Requirement Number and Definition: Information Required Explanation Constraints List constraints precluding compliance with the original requirement. Objective Define the objective of the original control; identify the objective met by the compensating control. Identified Risk Identify any additional risk posed by the lack of the original control. Definition of Compensating Controls Define the compensating controls and explain how they address the objectives of the original control and the increased risk, if any. Validation of Compensating Controls Define how the compensating controls were validated and tested. Maintenance Define process and controls in to maintain compensating controls. Appendix C: Explanation of Non-Applicability If the “N/A” (Not Applicable) column was checked in the questionnaire, use this worksheet to explain why the related requirement is not applicable to your organization. Requirement Reason Requirement is Not Applicable Example: 3.4 Cardholder data is never stored electronically
3 Protect stored cardholder data 4 Encrypt transmission of cardholder data across open, public networks 5 Protect all systems against malware and regularly update software or programs 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 8 Identify and authenticate access to system components 9 Restrict physical access to cardholder data 10 Track and monitor all access to network resources and cardholder data 11 Regularly test security systems and processes 12 Maintain a policy that addresses information security for all personnel * PCI DSS Requirements indicated here refer to the questions in Section 2 of the SAQ.