Is firmware on wireless devices updated to support strong encryption for authentication and transmission over wireless networks? Review policies and procedures Review vendor documentation Examine system configurations Are other security-related wireless vendor defaults changed, if applicable? Review policies and procedures Review vendor documentation Examine system configurations 2.2.2 Are only necessary services, protocols, daemons, etc. enabled as required for the function of the system (services and protocols not directly needed to perform the device’s specified function are disabled)? Review configuration standards Examine system configurations Are all enabled insecure services, daemons, or protocols justified per documented configuration standards? Review configuration standards Interview personnel Examine configuration settings Compare enabled services, etc. to documented justifications 2.2.3 Are additional security features documented and implemented for any required services, protocols or daemons that are considered to be insecure? Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Review configuration standards Examine configuration settings 2.2.4 Are system administrators and/or personnel that configure system components knowledgeable about common security parameter settings for those system components? Interview personnel Are common system security parameters settings included in the system configuration standards? Review system configuration standards
3.3 Is the PAN masked when displayed (the first six and last four digits are the maximum number of digits to be displayed) such that only personnel with a legitimate business need can see more than the first six/last four digits of the PAN? Note: This requirement does not supersede stricter requirements in place for displays of cardholder example, legal or payment card brand requirements for point-of-sale (POS) receipts. Review policies and procedures Review roles that need access to displays of full PAN Examine system configurations Observe displays of PAN Requirement 4: Encrypt transmission of cardholder data across open, public networks PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 4.1 (a) Are strong cryptography and security protocols used to safeguard sensitive cardholder data during transmission over open, public networks? Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Service (GPRS). Review documented standards Review policies and procedures Review all locations CHD is transmitted or received Examine system configurations (b) Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates
5.1 Is anti-virus software deployed on all systems commonly affected by malicious software? Examine system configurations 5.1.1 Are anti-virus programs capable of detecting, removing, and protecting against all known types of malicious software (for example, viruses, Trojans, worms, spyware, adware, and rootkits)? Review vendor documentation Examine system configurations 5.1.2 Are periodic evaluations performed to identify and evaluate evolving malware threats in order to confirm whether those systems considered to not be commonly affected by malicious software continue as such? Interview personnel 5.2 Are all anti-virus mechanisms maintained as follows: Are all anti-virus software and definitions kept current? Examine policies and procedures Examine anti-virus configurations, including the master installation Examine system components Are automatic updates and periodic enabled and being performed? Examine configurations, including the master installation Examine system components Are all anti-virus mechanisms generating audit logs, and are logs retained in accordance with PCI DSS Requirement 10.7? Examine anti-virus configurations Review log retention processes 5.3 Are all mechanisms: Actively running? Unable to be disabled or altered by users? Note: Anti-virus solutions may be temporarily disabled only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must be formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active. Examine anti-virus configurations Examine system components Observe processes Interview personnel
Requirement 6: Develop and maintain secure systems and applications PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 6.1 Is a process to identify security vulnerabilities, including the following: Using reputable outside sources for vulnerability information? Assigning a risk ranking to vulnerabilities that includes identification of all “high” risk and “critical” vulnerabilities? Note: Risk rankings should be based on industry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score and/or the classification by the vendor, and/or type of systems affected. Methods for evaluating vulnerabilities and assigning risk ratings will vary based on an organization’s environment and risk strategy. Risk rankings should, at a minimum, identify all vulnerabilities considered to be a “high risk” to the environment. In addition to the risk ranking, vulnerabilities may be considered “critical” if they pose an imminent threat to the environment, impact critical systems, and/or would result in a potential compromise if not addressed. Examples of critical systems may include security systems, public-facing devices and systems, databases, and other systems that store, process or transmit cardholder data. Review policies and procedures Interview personnel Observe processes 6.2 Are all system components and software protected from known vulnerabilities by installing applicable vendor-supplied security patches? Review policies and procedures
3 Protect stored cardholder data 4 Encrypt transmission of cardholder data across open, public networks 5 Protect all systems against malware and regularly update software or programs 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 8 Identify and authenticate access to system components 9 Restrict physical access to cardholder data 11 Regularly test security systems and processes 12 Maintain a policy that addresses information security for all personnel Appendix A2 Additional PCI DSS Requirements for Entities using SSL/early TLS * PCI DSS Requirements indicated here refer to the questions in Section 2 of the SAQ.