1.4 Is personal firewall software installed and active on any mobile and/or employee-owned devices that connect to the Internet when outside the network (for example, laptops used by employees), and which are also used to access the network? Review policies and configuration standards Examine mobile and/or devices Is the personal firewall software configured to specific configuration settings, actively running, and not alterable by of mobile and/or employee-owned devices? Review policies and configuration standards Examine mobile and/or devices 1.5 Are security policies and operational procedures for managing firewalls: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel
(f) For all environments using SSL and/or early TLS: Does the documented Risk Mitigation and Migration Plan include the following? Description of usage, including; what data is being transmitted, types and number of systems that use and/or support SSL/early TLS, type of environment; Risk assessment results and risk reduction controls in place; Description of processes to monitor for new vulnerabilities associated with SSL/early TLS; Description of change control processes that are implemented to ensure SSL/early TLS is not implemented into new environments; Overview of migration project plan including target migration completion date no later than 30th June 2016. Review Risk Mitigation and Migration Plan 2.4 (a) Is an inventory maintained for systems components that are in for PCI DSS, including a list of hardware and software components and a description of function/use for each? Examine system inventory (b) Is the documented inventory kept current? Interview personnel 2.5 Are security policies and operational procedures for managing vendor defaults and security parameters: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel 2.6 This requirement applies only to service providers. Protect Cardholder Data
3.2.1 The full contents of any track (from the magnetic stripe located on the back of a card, equivalent data contained on a chip, or elsewhere) are not stored after authorization? This data is alternatively called full track, track, track 1, track 2, and magnetic-stripe data. Note: In the normal course of business, the following data elements from the magnetic stripe may need to be retained: The cardholder’s name, Primary account number (PAN), Expiration date, and Service code To minimize risk, only these data elements as needed for business. Examine data sources including: Incoming transaction data All logs History Trace files Database schema Database contents 3.2.2 The card verification code or value (three-digit or four-digit number printed on the front or back of a payment card) is not stored after authorization? Examine data sources including: Incoming transaction data All logs History Trace files Database schema Database contents 3.2.3 The personal identification number (PIN) or the encrypted PIN is not stored after authorization? Examine data sources including: Incoming transaction data All logs History Trace files Database schema Database contents
3.6.3 Do cryptographic key procedures include secure cryptographic key storage? Review key-management procedures Observe the method for secure storage of keys 3.6.4 Do cryptographic key procedures include cryptographic key changes for keys that have reached the end of defined cryptoperiod (for example, after a defined period of time has passed and/or after a certain amount of cipher-text has been produced by a given key), as defined by the associated application vendor or key owner, and based on industry best practices and guidelines (for example, NIST Special Publication 800-57)? Review key-management procedures Interview personnel 3.6.5 Do cryptographic key procedures include retirement or replacement (for example, archiving, destruction, and/or revocation) of cryptographic keys when the integrity of the key has been weakened (for example, departure of an employee with knowledge of a key)? Review key-management procedures Interview personnel Do cryptographic key procedures include replacement of known or suspected compromised keys? Review key-management procedures Interview personnel If retired or replaced cryptographic keys are retained, are these keys only used for decryption/verification purposes, and not used for encryption operations? Review key-management procedures Interview personnel
3.6.6 If manual clear-text key-management operations are used, do cryptographic key procedures include split knowledge and dual control of cryptographic keys as follows: Do split knowledge procedures require that key components are under the control of at least two people who only have knowledge of their own key components? AND Do dual control procedures require that at least two people are required to perform any key management operations and no one person has access to the authentication materials (for example, passwords or keys) of another? Note: Examples of manual key management operations include, but are not limited to: key generation, transmission, loading, storage and destruction. Review key-management procedures Interview personnel and/or Observe processes 3.6.7 Do cryptographic key procedures include the prevention of unauthorized substitution of cryptographic keys? Review procedures Interview personnel and/or Observe processes 3.6.8 Are cryptographic key custodians required to formally acknowledge (in writing or electronically) that they understand and accept key-custodian responsibilities? Review procedures Review documentation or other evidence 3.7 Are security policies and operational procedures for protecting stored cardholder data: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel
8.1.4 Are inactive user accounts either removed or disabled within 90 days? Review password procedures Observe user accounts 8.1.5 Are accounts used by vendors to access, support, or maintain system components via remote access enabled only during the time period needed and disabled when not in use? Review password procedures Interview personnel Observe processes Are vendor remote access accounts monitored when in use? Interview personnel Observe processes 8.1.6 Are repeated access attempts limited by locking out the user ID after no more than six attempts? Review password procedures Examine system configuration settings This testing procedure applies only to service providers. 8.1.7 Once a user account is locked out, is the lockout duration set to a minimum of 30 minutes or an administrator enables the user ID? Review password procedures Examine system configuration settings 8.1.8 If a session has been idle for more than 15 minutes, are users required to re-authenticate (for example, re-enter the password) to re-activate the terminal or session? Review password procedures Examine system configuration settings 8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes
Do authentication policies and procedures include the following? Guidance on selecting strong authentication credentials Guidance for how users should protect their authentication credentials Instructions not to previously used passwords Instructions that users should change passwords if there is any suspicion the password could be compromised Review policies and procedures Review documentation provided to 8.5 Are shared, or generic accounts, passwords, or other authentication methods prohibited as follows: Generic user IDs and accounts are disabled or removed; Shared user IDs for system administration activities and other critical functions do not exist; and Shared and generic user IDs are not used to administer any system components? Review policies and procedures Examine user ID Interview personnel 8.5.1 This requirement applies only to service providers. 8.6 Where other authentication mechanisms are used (for example, physical or logical security tokens, smart cards, and certificates, etc.), is the use of these mechanisms assigned as follows? Authentication mechanisms must be assigned to an individual account and not shared among multiple accounts Physical and/or logical controls must be in place to ensure only the intended account can use that mechanism to gain access Review policies and procedures Interview personnel Examine system configuration settings and/or physical controls
9.1.3 Is physical access to wireless access points, gateways, handheld devices, networking/communications hardware, and telecommunication lines restricted? Review policies and procedures Interview personnel Observe devices 9.2 Are procedures developed to easily distinguish between onsite personnel and visitors, which include: Identifying onsite personnel and visitors (for example, assigning badges), Changing access requirements, and Revoking terminated onsite personnel and expired visitor identification (such as ID badges) For the purposes of Requirement 9, “onsite personnel” refers to full-time and part-time employees, temporary employees, contractors and consultants who are physically present on the entity’s premises. A “visitor” refers to a vendor, guest of any onsite personnel, service workers, or anyone who needs to enter the facility for a short duration, usually not more than one day. Review policies and procedures Interview personnel Observe identification methods (e.g. badges) Observe visitor processes Do identification methods (such as ID badges) clearly identify visitors and easily distinguish between onsite personnel and visitors? Observe identification methods Is access to the badge system limited to authorized personnel? Observe physical controls and access controls for the badge system 9.3 Is physical access to sensitive areas controlled for onsite personnel, as follows: Is access authorized and based on individual job function? Is access revoked immediately upon termination Upon termination, are all physical access mechanisms, such as keys, access cards, etc., returned or disabled? Interview personnel Examine access control lists Observe onsite personnel Compare lists of terminated employees to access control lists
9.5.1 Are media back-ups stored in a secure location, preferably in an off-site facility, such as an alternate or backup site, or a commercial storage facility? Observe physical security at media location Is this location’s security reviewed at least annually? Review policies and procedures for reviewing offsite media locations Interview security personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for classification Interview security personnel 9.6.2 Is sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.7.1 Are inventory logs of all media properly maintained? Examine inventory logs Are periodic media inventories conducted at least annually? Examine inventory logs Interview personnel 9.8 Is all media destroyed when it is no longer needed for business or legal reasons? Review periodic destruction policies and procedures
Is there a periodic media destruction policy that defines requirements for the following? Hard-copy materials must be crosscut shredded, incinerated, or pulped such that there is reasonable assurance the hard-copy materials cannot be reconstructed. Storage containers used for materials that are to be destroyed must be secured. Cardholder data on electronic media must be rendered unrecoverable (e.g. via a secure wipe program in accordance with industry-accepted standards for secure deletion, or by physically destroying the media). Review periodic media destruction policies and procedures Is destruction performed as follows: 9.8.1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Interview personnel Examine procedures Observe processes Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents? Examine security of storage containers 9.8.2 Is cardholder data on electronic rendered unrecoverable (e.g. via a secure wipe program in accordance with industry-accepted standards for secure deletion, or otherwise by physically destroying the media), so that cardholder data cannot be reconstructed? Observe processes Interview personnel
11.6 Are security policies and operational procedures for security monitoring and testing: Documented In use Known to all affected parties? Examine security policies and operational procedures Interview personnel Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security for all personnel Note: For the purposes of Requirement 12, “personnel” refers to full-time part-time employees, temporary employees and personnel, and contractors and consultants who are “resident” on the entity’s site or otherwise have access to the company’s site cardholder data environment. PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 12.1 Is a security policy established, published, maintained, and disseminated to all relevant personnel? Review the information security policy 12.1.1 Is the security policy reviewed at least annually and updated when the environment changes? Review the information security policy Interview responsible personnel 12.2 (a) Is an annual risk assessment process implemented that Identifies critical assets, threats, and vulnerabilities, and Results in a formal, documented analysis of risk? Examples of risk assessment methodologies include but are not limited to OCTAVE, ISO and NIST SP 800-30. Review annual risk assessment process Interview personnel
3 Protect stored cardholder data 4 Encrypt transmission of cardholder data across open, public networks 5 Protect all systems against malware and regularly update software or programs 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 8 Identify and authenticate access to system components 9 Restrict physical access to cardholder data 10 and monitor all access to network resources and cardholder data 11 Regularly test security systems and processes 12 Maintain a policy that addresses information security for all personnel