Section 2: Self-Assessment Questionnaire A-EP Note: The following questions are numbered according to PCI DSS requirements and testing procedures, as defined in the PCI DSS Requirements and Security Assessment Procedures document. Self-assessment completion date: Build and Maintain a Secure Network Requirement 1: Install and maintain a firewall configuration to protect data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 1.1 Are firewall and router configuration standards established and implemented to include the following: 1.1.1 Is there a formal process for approving and testing all network connections and changes to the firewall and router configurations? Review documented process Interview personnel Examine network configurations 1.1.2 (a) Is there a current network diagram that documents all connections between the cardholder data environment and other networks, including any wireless networks? Review current network diagram Examine network configurations (b) Is there a process to ensure the diagram is kept current? Interview responsible personnel 1.1.3 (a) Is there a current diagram that shows all cardholder data flows across systems and networks? Review current dataflow diagram Examine network configurations. (b) Is a process to ensure the diagram is kept current? Interview personnel 1.1.4 Is a firewall required and implemented at each Internet connection and between any demilitarized zone (DMZ) and the internal network zone? Review firewall configuration standards Observe network configurations to verify that a firewall(s) is in place
1.2.2 Are router configuration files secured from unauthorized access and synchronized—for example, the running (or active) configuration matches the start-up configuration (used when machines are booted)? Review firewall and router configuration standards Examine router configuration files and router configurations 1.2.3 Are perimeter firewalls installed between all wireless networks and the cardholder data environment, and are these firewalls configured to deny or, if traffic is necessary for business purposes, permit only authorized traffic between the wireless environment and the cardholder data environment? Review firewall and router configuration standards Examine firewall and router configurations 1.3 Is direct public access prohibited between the Internet and any system component in the cardholder data environment, as follows: 1.3.1 Is a DMZ implemented to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports? Examine firewall and router configurations 1.3.2 Is inbound Internet traffic limited to IP addresses within the DMZ? Examine firewall and router configurations 1.3.3 Are anti-spoofing measures implemented to detect and block forged sourced IP addresses from entering the network? (For example, block traffic originating from the internet with an internal address) Examine firewall and router configurations 1.3.4 Is outbound traffic from the cardholder data environment to the Internet explicitly authorized? Examine firewall and router configurations 1.3.5 Are only established connections permitted into the network? Examine firewall and router configurations
2.3 Is non-console administrative access encrypted as follows: Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Is all non-console administrative access encrypted with strong cryptography, and is a strong encryption method invoked before the administrator’s password is requested? Examine system components Examine system configurations Observe an administrator log on Are system services and parameter files configured to prevent the use of Telnet and other insecure remote login commands? Examine system components Examine services and files Is administrator access to web-based management interfaces encrypted with strong cryptography? Examine system components Observe an administrator log on For the technology in use, is strong cryptography implemented according to industry best practice and/or vendor recommendations? Examine system components Review vendor documentation Interview personnel Protect Cardholder Data Requirement 3: Protect stored cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 3.2 (c) Is sensitive authentication data deleted or rendered unrecoverable upon completion of the authorization process? Review policies and procedures Examine system configurations Examine deletion processes
Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 9.1 Are appropriate facility entry controls in place to limit and monitor physical access to systems in the cardholder data environment? Observe physical access controls Observe personnel 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing media Interview personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for media classification Interview security personnel 9.6.2 Is sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.8 Is all media destroyed when it is no longer needed for business or legal reasons? Review periodic media destruction policies and procedures (c) Is media destruction performed as follows:
10.5.5 Is file-integrity monitoring or change-detection software used on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert)? Examine settings, monitored files, and results from monitoring activities 10.6 Are logs and security events for all system components reviewed to identify anomalies or suspicious activity as follows? Note: Log harvesting, parsing, and alerting tools may be used to achieve compliance with Requirement 10.6. 10.6.1 (b) Are the following logs and security events reviewed at least daily, either manually or via log tools? All security events Logs of all system components that store, process, or transmit CHD and/or SAD Logs of all critical system components Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.) Review security policies and procedures Observe processes Interview personnel 10.6.2 (b) Are logs of all other system components periodically reviewed—either manually or via log tools—based on the organization’s policies and risk management strategy? Review security policies and procedures Review risk assessment documentation Interview personnel 10.6.3 (b) Is follow up to exceptions and anomalies identified during the review process performed? Review security policies and procedures Observe processes Interview personnel prevention
11.4 Are intrusion-detection and/or intrusion-prevention techniques that detect and/or prevent intrusions into the network in place to monitor all traffic: At the perimeter of the cardholder data environment, and At critical points in the cardholder data environment. Examine system configurations Examine network diagrams Are intrusion-detection and/or intrusion-prevention techniques configured to alert personnel of suspected compromises? Examine system configurations Interview responsible personnel Are all intrusion-detection and engines, baselines, and signatures kept up-to-date? Examine IDS/IPS configurations Examine vendor documentation 11.5 Is a change-detection mechanism (for example, monitoring tools) deployed to detect unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files, or content files? Examples of files that should be monitored include: System executables Application executables Configuration and parameter files Centrally stored, historical or archived, log, and audit files Additional critical determined by entity (for example, through risk assessment or other means) Observe system settings and monitored files Examine system configuration settings
Is the change-detection mechanism configured to alert personnel to unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files or content files, and do the tools perform critical file comparisons at least weekly? Note: For change detection purposes, critical are usually those that do not regularly change, but the modification of which could indicate a system compromise or risk of compromise. Change detection mechanisms such as monitoring products usually come pre-configured with critical files for the operating system. Other critical files, such as those for custom applications, must be evaluated and defined by the entity (that is the merchant or service provider). Observe system settings and monitored files Review results from monitoring activities 11.5.1 Is a process in place to respond to any alerts generated by the change-detection solution? Examine system configuration settings Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security for all personnel Note: For the purposes of Requirement 12, “personnel” refers to full-time part-time employees, temporary employees and personnel, and contractors and consultants who are “resident” on the entity’s site or otherwise have access to the company’s site cardholder data environment. PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 12.1 Is a security policy established, published, maintained, and disseminated to all relevant personnel? Review the information security policy