Document Changes Date PCI DSS Version SAQ Revision Description October 2008 1.2 To align content with new PCI DSS v1.2 and to implement minor changes noted since original v1.1. October 2010 2.0 To align content with new PCI DSS v2.0 requirements and testing procedures. February 2014 3.0 To align content with PCI DSS v3.0 requirements and testing procedures and incorporate additional response options. April 2015 3.1 Updated to align with PCI DSS v3.1. For details of PCI DSS changes, see PCI DSS – Summary of Changes from PCI DSS Version 3.0 to 3.1. July 2015 3.1 1.1 Updated to remove references to “best practices” prior to June 30, 2015, and remove the PCI DSS v2 reporting option for Requirement 11.3. April 2016 3.2 1.0 Updated to align with PCI DSS v3.2. For details of PCI DSS changes, see PCI DSS – Summary of Changes from PCI DSS Version 3.1 to 3.2. January 2017 3.2 1.1 Updated version numbering to align with other SAQs Table of Contents
Is the current network diagram consistent with the firewall configuration standards? Compare firewall configuration standards to current network diagram 1.1.5 Are groups, roles, and responsibilities for logical management of network components assigned and documented in the firewall and router configuration standards? Review firewall and router configuration standards Interview personnel 1.1.6 Do firewall and router configuration standards include a documented list of services, protocols, and ports, including business justification and approval for each? Review firewall and router configuration standards Are all insecure services, protocols, and ports identified, and are security features documented and implemented for each identified service? Review firewall and router configuration standards Examine firewall and router configurations 1.1.7 Do firewall and router configuration standards require review of firewall and router rule sets at least every six months? Review firewall and router configuration standards Are firewall and router rule sets reviewed at least every six months? Examine documentation from firewall reviews 1.2 Do firewall and router configurations restrict connections between untrusted networks and any system in the cardholder data environment as follows: Note: An “untrusted network” is any network that is external to the networks belonging to the entity under review, and/or which is out of the entity’s ability to control or manage. 1.2.1 Is inbound and outbound traffic restricted to that which is necessary for the cardholder data environment? Review firewall and router configuration standards Examine firewall and router configurations
Is firmware on wireless devices updated to support strong encryption for authentication and transmission over wireless networks? Review policies and procedures Review vendor documentation Examine system configurations Are other security-related wireless vendor defaults changed, if applicable? Review policies and procedures Review vendor documentation Examine system configurations 2.2 Are configuration standards developed for all system components and are they consistent with system hardening standards? Sources of industry-accepted system hardening standards may include, but are not limited to, SysAdmin Network Security (SANS) Institute, National Institute of Standards Technology (NIST), International Organization for Standardization (ISO), and Center for Internet Security (CIS). Review system configuration standards Review industry-accepted hardening standards Review policies and procedures Interview personnel Are system configuration standards updated as new vulnerability issues are identified, as defined in Requirement 6.1? Review policies and procedures Interview personnel Are system configuration standards applied when new systems are configured? Review policies and procedures Interview personnel
Requirement 3: Protect stored cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 3.1 Are data-retention and disposal policies, procedures, and processes implemented as follows: Is data storage amount and retention time limited to that required for legal, regulatory, and/or business requirements? Review data retention and disposal policies and procedures Interview personnel Are there defined processes in place for securely deleting cardholder data when no longer needed for legal, regulatory, and/or business reasons? Review policies and procedures Interview personnel Examine deletion mechanism Are there specific retention requirements for cardholder data? For example, cardholder data needs to be held for X period for Y business reasons. Review policies and procedures Interview personnel Examine retention requirements Is there a quarterly process for identifying and securely deleting stored cardholder data that exceeds defined retention requirements? Review policies and procedures Interview personnel Observe deletion processes Does all stored cardholder data meet the requirements defined in the data-retention policy? Examine files and system records 3.2 This testing procedure applies only to Issuers. This testing procedure applies only to Issuers. Is sensitive authentication data deleted or rendered unrecoverable upon completion of the authorization process? Review policies and procedures Examine system configurations Examine deletion processes
3.5.3 Are secret and private cryptographic keys used to encrypt/decrypt cardholder data stored in one (or more) of the following forms at all times? Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data-encrypting key Within a secure cryptographic device (such as a hardware (host) security module (HSM) or point-of-interaction device) As at least two full-length key components or key shares, in accordance with an industry-accepted method. Note: It is not required that public keys be stored in one of these forms. Review documented procedures Examine system configurations and key storage locations, including for key-encrypting keys 3.5.4 Are cryptographic keys stored in the fewest possible locations? Examine key-storage locations Observe processes 3.6 Are all key-management processes and procedures fully documented and implemented for cryptographic keys used for encryption of cardholder data? Review key-management procedures This testing procedure applies only to service providers. Are key-management processes and procedures implemented to require the following: 3.6.1 Do cryptographic key procedures include the generation of strong cryptographic keys? Review key-management procedures Observe key-generation method approved
4.1.1 Are industry best practices used to implement strong encryption for authentication and transmission for wireless networks transmitting cardholder data or connected to the cardholder data environment? Review documented standards Review wireless networks Examine system configuration settings 4.2 Are PANs rendered unreadable or secured with strong cryptography whenever they are sent via end-user messaging technologies (for example, e-mail, instant messaging, SMS, chat, etc.)? Observe processes Review outbound transmissions Are policies in that state that unprotected PANs are not to be sent via end-user messaging technologies? Review policies and procedures 4.3 Are security policies and operational procedures for transmissions of cardholder data: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel Maintain a Vulnerability Management Program Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 5.1 Is anti-virus software deployed on all systems commonly affected by malicious software? Examine system configurations
6.4.1 Are development/test environments separate from the production environment? Review change control processes and procedures Examine network documentation and network device configurations Is access control in place to enforce the separation between the development/test environments and the production environment? Review change control processes and procedures Examine access control settings 6.4.2 Is separation of duties between personnel assigned to the development/test environments and those assigned to the production environment? Review change control processes and procedures Observe processes Interview personnel 6.4.3 Are production data (live PANs) not used for testing or development? Review change control processes and procedures Observe processes Interview personnel Examine test data 6.4.4 Are test data and accounts removed from system components before the system becomes active / goes into production? Review change control processes and procedures Observe processes Interview personnel Examine production systems
6.5.7 Do coding techniques address cross-site scripting (XSS) vulnerabilities? Examine policies and procedures Interview responsible personnel 6.5.8 Do coding techniques address improper access control such as insecure direct object references, failure to restrict URL access, directory traversal, and failure to restrict user access to functions? Examine policies and procedures Interview responsible personnel 6.5.9 Do coding techniques address cross-site request forgery (CSRF)? Examine policies and procedures Interview responsible personnel 6.5.10 Do coding techniques address broken authentication and session management? Examine policies and procedures Interview responsible personnel
8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes 8.2.1 Is strong cryptography used to render all authentication credentials (such as passwords/passphrases) unreadable during transmission and storage on all system components? Review password procedures Review vendor documentation Examine system configuration settings Observe password files Observe data transmissions This testing procedure applies only to service providers. 8.2.2 Is user identity verified before modifying any authentication credential (for example, performing password resets, provisioning new tokens, or generating new keys)? Review authentication procedures Observe personnel 8.2.3 Are user password parameters configured to require passwords/passphrases meet the following? A minimum password length of at least seven characters Contain both numeric and alphabetic characters Alternatively, the passwords/passphrases must have complexity and strength at least equivalent to the parameters specified above. Examine system configuration settings to verify password parameters This testing procedure applies only to service providers.
8.2.4 Are user passwords/passphrases changed at least once every 90 days? Review password procedures Examine system configuration settings This testing procedure applies only to service providers. 8.2.5 Must an individual submit a new password/passphrase that is different from any of the last four passwords/passphrases he or she has used? Review password procedures Sample system components Examine system configuration settings This testing procedure applies only to service providers. 8.2.6 Are passwords/passphrases set to a unique value for each user for first-time use and upon reset, and must each user change their password immediately after the first use? Review password procedures Examine system configuration settings Observe security personnel 8.3 Is all individual non-console administrative access and all remote access to the CDE secured using multi-factor authentication as follows: Note: Multi-factor authentication requires that a minimum of two of the three authentication methods (see PCI DSS Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered multi-factor authentication. 8.3.1 Is authentication incorporated for all access into the CDE for personnel with administrative access? Note: This requirement is a best practice January 31, 2018, after which it becomes a requirement. Examine system configurations Observe administrator logging into CDE
9.4 Is visitor identification and access handled as follows: 9.4.1 Are visitors authorized before entering, and escorted at all times within, areas where cardholder data is processed or maintained? Review policies and procedures Observe visitor processes including how access is controlled Interview personnel Observe visitors and use 9.4.2 Are visitors identified and given a badge or other identification that visibly distinguishes the visitors from onsite personnel? Observe badge use of personnel and visitors Examine identification Do visitor badges or identification expire? Observe process Examine identification 9.4.3 Are visitors asked to surrender the badge or other identification before leaving the facility or at the date of expiration? Observe processes Observe visitors leaving facility 9.4.4 Is a visitor log in use to record physical access to the facility as well as for computer rooms and data centers where cardholder data is stored or transmitted? Review policies and procedures Examine the visitor log Observe visitor processes Examine log retention Does the visitor log contain the visitor’s name, the firm represented, and the onsite personnel authorizing physical access? Review policies and procedures Examine the visitor log Is the visitor log retained for at least three months? Review policies and procedures Examine visitor log retention 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, “media” refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing Interview personnel
9.5.1 Is the location media back-ups are stored reviewed at least annually to confirm storage is secure? Review policies and procedures for reviewing offsite locations Interview security personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for media classification Interview security personnel 9.6.2 Is media sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.7.1 Are inventory logs of all media properly maintained? Examine inventory logs Are periodic inventories conducted at least annually? Examine inventory logs Interview personnel 9.8 Is all media destroyed when it is no longer needed for business or legal reasons? Review periodic media destruction policies and procedures
10.6.1 Are written policies and procedures defined for reviewing the following at least daily, either manually or via log tools? All security events Logs of all system components that store, process, or transmit CHD and/or SAD Logs of all critical system components Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.) Review security policies and procedures Are the above logs and security events reviewed at least daily? Observe processes Interview personnel 10.6.2 Are written policies and procedures defined for reviewing logs of all other system components periodically—either manually or via log on the organization’s policies and risk management strategy? Review security policies and procedures Are reviews of all system components performed in accordance with organization’s policies and risk management strategy? Review risk assessment documentation Interview personnel 10.6.3 Are written policies and procedures defined for following up on exceptions and anomalies identified during the review process? Review security policies and procedures Is follow up to exceptions and anomalies performed? Observe processes Interview personnel 10.7 Are audit log retention policies and procedures in place and do they require that logs are retained for at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from backup)? Review security policies and procedures
Are audit logs retained for at least one year? Interview personnel Examine audit logs Are at least the last three months’ logs immediately available for analysis? Interview personnel Observe processes 10.8 This requirement applies only to service providers 10.9 Are security policies and operational procedures for monitoring all access to network resources and cardholder data: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel
Appendix D: Explanation of Requirements Not Tested If the “Not Tested” column was checked in the questionnaire, use this worksheet to explain why the related requirement was not reviewed as part of the assessment. Requirement Describe which part(s) of the requirement was not tested Describe why requirements were not tested Examples: Requirement 12 Requirement 12.2 was the only requirement tested. All other requirements from Requirement 12 were excluded. This assessment only covers requirements in Milestone 1 of the Prioritized Approach. Requirements 1-8, 10-12 Only Requirement 9 was reviewed for this assessment. All other requirements were excluded. Company is a physical hosting provider and only physical security controls were considered for this assessment.
3 Protect stored cardholder data 4 Encrypt transmission of cardholder data across open, public networks 5 Protect all systems against malware and regularly update software or programs 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 8 Identify and authenticate access to system components 9 Restrict physical access to cardholder data 10 Track and monitor all access to network resources and cardholder data 11 Regularly test security systems and processes 12 Maintain a policy that addresses information security for all personnel Appendix A2 Additional PCI DSS Requirements for Entities using SSL/early TLS