Document Changes Date PCI DSS Version SAQ Revision Description October 2008 1.2 To align content with new PCI DSS v1.2 and to implement minor changes noted since original v1.1. October 2010 2.0 To align content with new PCI DSS v2.0 requirements and testing procedures. February 2014 3.0 To content with PCI DSS v3.0 requirements and testing procedures and incorporate additional response options. April 2015 3.1 Updated to with PCI DSS v3.1. For details of PCI DSS changes, see PCI DSS – Summary of Changes from PCI DSS Version 3.0 to 3.1. July 2015 3.1 1.1 Updated to remove references to “best practices” prior to June 30, 2015, and remove the PCI DSS v2 reporting option for Requirement 11.3. April 2016 3.2 1.0 Updated to align with PCI DSS v3.2. For details of PCI DSS changes, see PCI DSS – Summary of Changes from PCI DSS Version 3.1 to 3.2. January 2017 3.2 1.1 Updated version numbering to with other SAQs Table of Contents
6.5.7 Do coding techniques address scripting (XSS) vulnerabilities? Examine policies and procedures Interview responsible personnel 6.5.8 Do coding techniques address improper access control such as insecure direct object references, failure to restrict URL access, directory traversal, and failure to restrict user access to functions? Examine policies and procedures Interview responsible personnel 6.5.9 Do coding techniques address cross-site request forgery (CSRF)? Examine policies and procedures Interview responsible personnel 6.5.10 Do coding techniques address broken authentication and session management? Examine policies and procedures Interview responsible personnel
7.2.3 Does the access control system(s) have a default setting? Review vendor documentation Examine configuration settings 7.3 Are security policies and operational procedures for restricting access to cardholder data: Documented In use to all affected parties? Examine security policies and operational procedures Interview personnel Requirement 8: Identify and authenticate access to system components PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 8.1 Are policies and procedures for user identification management controls defined and in for users and administrators on all system components, as follows: 8.1.1 Are all assigned a unique ID before allowing them to access system components or cardholder data? Review password procedures Interview personnel 8.1.2 Are additions, deletions, and modifications of user IDs, credentials, and other identifier objects controlled such that user IDs are implemented only as authorized (including with specified privileges)? Review password procedures Examine privileged and general user IDs and associated authorizations Observe system settings
8.1.3 Is access for any terminated users immediately deactivated or removed? Review password procedures Examine terminated users accounts Review current access lists Observe returned physical authentication devices 8.1.4 Are inactive user accounts either removed or disabled within 90 days? Review password procedures Observe user accounts 8.1.5 Are accounts used by third parties to access, support, or maintain system components via remote access enabled only during the time period needed and disabled when not in use? Review password procedures Interview personnel Observe processes Are third party remote access accounts monitored when in use? Interview personnel Observe processes 8.1.6 Are repeated access attempts limited by locking out the user ID no more than six attempts? Review password procedures Examine system configuration settings This testing procedure applies only to service providers. 8.1.7 Once a user account is locked out, is the lockout duration set to a minimum of 30 minutes or until an administrator enables the user ID? Review password procedures Examine system configuration settings 8.1.8 If a session has been idle for more than 15 minutes, are users required to re-authenticate (for example, re-enter the password) to re-activate the terminal or session? Review password procedures Examine system configuration settings
8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes 8.2.1 Is strong cryptography used to render all authentication credentials (such as passwords/passphrases) unreadable during transmission and storage on all system components? Review password procedures Review vendor documentation Examine system configuration settings Observe password files Observe data transmissions This testing procedure applies only to service providers. 8.2.2 Is user identity verified before modifying any authentication credential (for example, performing password resets, provisioning new tokens, or generating new keys)? Review authentication procedures Observe personnel 8.2.3 Are user password parameters configured to require passwords/passphrases meet the following? A minimum password length of at least seven characters Contain both numeric and alphabetic characters Alternatively, the passwords/passphrases must have complexity and strength at least equivalent to the parameters specified above. Examine system configuration settings to verify password parameters This testing procedure applies only to service providers.
Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 9.1 Are appropriate facility entry controls in place to limit and monitor physical access to systems in the cardholder data environment? Observe physical access controls Observe personnel 9.1.1 Are either cameras or access-control mechanisms (or both) in place to monitor individual physical access to sensitive areas? Note: “Sensitive areas” refers to any data center, server room, or any area that houses systems that store, process, or transmit cardholder data. This excludes public-facing areas where only point-of-sale terminals are present such as the cashier areas in a retail store. Review policies and procedures Observe physical monitoring mechanisms Observe security features Are either video cameras or access-control mechanisms (or both) protected from tampering or disabling? Observe processes Interview personnel Is data collected from video cameras and/or access control mechanisms reviewed and correlated with other entries? Review policies and procedures Interview security personnel Is data collected from video cameras and/or access control mechanisms stored for at least three months unless otherwise restricted by law? Review data retention processes Observe data storage Interview security personnel 9.1.2 Are physical and/or logical controls in place to restrict access to publicly accessible network jacks? For example, network jacks located in public areas and areas accessible to visitors could be disabled and only enabled when network access is explicitly authorized. Alternatively, processes could be implemented to ensure that visitors are escorted at all times in areas with active network jacks. Review policies and procedures Interview personnel Observe locations
9.1.3 Is physical access to wireless access points, gateways, handheld devices, networking/communications hardware, and telecommunication lines restricted? Review policies and procedures Interview personnel Observe devices 9.2 Are procedures developed to easily distinguish between onsite personnel and visitors, which include: Identifying onsite personnel and visitors (for example, assigning badges), Changing access requirements, and Revoking terminated onsite personnel and expired visitor identification (such as ID badges) For the purposes of Requirement 9, “onsite personnel” refers to full-time and part-time employees, temporary employees, contractors and consultants who are physically present on the entity’s premises. A “visitor” refers to a vendor, guest of any onsite personnel, service workers, or anyone who needs to enter the facility for a short duration, usually not more than one day. Review policies and procedures Interview personnel Observe identification methods (e.g. badges) Observe visitor processes Do identification methods (such as ID badges) clearly identify visitors and easily distinguish between onsite personnel and visitors? Observe identification methods Is access to the system limited to authorized personnel? Observe physical controls and access controls for the badge system
9.3 Is physical access to sensitive controlled for onsite personnel, as follows: Is access authorized and based on individual job function? Is access revoked immediately upon termination Upon termination, are all physical access mechanisms, such as keys, access cards, etc., returned or disabled? Interview personnel Examine access control lists Observe onsite personnel Compare lists of terminated employees to access control lists 9.4 Is visitor identification and access handled as follows: 9.4.1 Are visitors authorized before entering, and escorted at all times within, areas where cardholder data is processed or maintained? Review policies and procedures Observe visitor processes including how access is controlled Interview personnel Observe visitors and badge use 9.4.2 Are visitors identified and given a badge or other identification that visibly distinguishes the visitors from onsite personnel? Observe badge use of personnel and visitors Examine identification Do visitor badges or other identification expire? Observe process Examine identification 9.4.3 Are visitors to surrender the badge or other identification before leaving the facility or at the date of expiration? Observe processes Observe visitors leaving facility 9.4.4 Is a visitor log in use to record physical access to the facility as well as for computer rooms and data centers where cardholder data is stored or transmitted? Review policies and procedures Examine the visitor log Observe visitor processes Examine log retention Does the visitor log contain the visitor’s name, the firm represented, and the onsite personnel authorizing physical access? Review policies and procedures Examine the visitor log
(b) Have personnel at locations received training, and are they aware of procedures to detect and report attempted tampering or replacement of devices? Interview personnel at POS locations 9.10 Are security policies and operational procedures for restricting physical access to cardholder data: Documented In use to all affected parties? Examine security policies and operational procedures Interview personnel Regularly Monitor and Test Networks Requirement 10: Track and monitor all access to network resources and cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 10.1 Are audit trails enabled and active for system components? Observe processes Interview system administrator Is access to system components linked to individual users? Observe processes Interview system administrator 10.2 Are automated audit trails implemented for all system components to reconstruct the following events:
Are logs retained for at least one year? Interview personnel Examine audit logs Are at least the last three months’ logs immediately available for analysis? Interview personnel Observe processes 10.8 This requirement applies only to service providers 10.9 Are security policies and operational procedures for monitoring all access to network resources and cardholder data: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel
Is the change-detection mechanism configured to personnel to unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files or content files, and do the tools perform critical file comparisons at least weekly? Note: For change detection purposes, critical files are usually those that do not regularly change, but the modification of which could indicate a system compromise or risk of compromise. Change detection mechanisms such as monitoring products usually come pre-configured with critical files for the related operating system. Other critical files, such as those for custom applications, must be evaluated and defined by the entity (that is the merchant or service provider). Observe system settings and monitored files Review results from monitoring activities 11.5.1 Is a process in place to respond to any alerts generated by the change-detection solution? Examine system configuration settings 11.6 Are security policies and operational procedures for security monitoring and testing: Documented In use Known to all affected parties? Examine security policies and operational procedures Interview personnel Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security for all personnel Note: For the purposes of Requirement 12, “personnel” refers to full-time part-time employees, temporary employees and personnel, and contractors and consultants who are “resident” on the entity’s site or otherwise have access to the company’s site cardholder data environment. PCI DSS Question Expected Testing Response (Check one response for each question)
Requirement Describe which part(s) of the requirement was not tested Describe why requirements were not tested Examples: Requirement 12 Requirement 12.2 was the only requirement tested. All other requirements from Requirement 12 were excluded. This assessment only covers requirements in Milestone 1 of the Prioritized Approach. Requirements 1-8, 10-12 Only Requirement 9 was reviewed for this assessment. All requirements were excluded. Company is a physical hosting provider and only physical security controls were considered for this assessment.