1.3 Is direct public access prohibited between the Internet and any system component in the cardholder data environment, as follows: 1.3.4 Is outbound traffic from the cardholder data environment to the Internet explicitly authorized? Examine firewall and router configurations 1.3.5 Are only established connections permitted into the network? Examine firewall and router configurations 1.4 Is personal firewall software (or equivalent functionality) installed and active on any portable computing devices (including company and/or that connect to the Internet when outside the network (for example, laptops used by employees), and which are also used to access the CDE? Review policies and configuration standards Examine mobile and/or devices Is the personal firewall software (or equivalent functionality) configured to specific configuration settings, actively running, and not alterable by users of mobile and/or employee-owned devices? Review policies and configuration standards Examine mobile and/or devices
Requirement 2: Do not use vendor-supplied defaults for system passwords and security parameters PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 2.1 Are vendor-supplied defaults always changed before installing a system on the network? This applies to ALL default passwords, including but not limited to used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, payment applications, Simple Network Management Protocol (SNMP) community strings, etc.). Review policies and procedures Examine vendor documentation Observe system configurations and account settings Interview personnel Are unnecessary default accounts removed or disabled before installing a system on the network? Review policies and procedures Review vendor documentation Examine system configurations and account settings Interview personnel 2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data, are ALL wireless vendor defaults changed at installations, as follows: Are encryption keys changed from default at installation, and changed anytime anyone with knowledge of the keys leaves the company or changes positions? Review policies and procedures Review vendor documentation Interview personnel Are default SNMP community strings on wireless devices changed at installation? Review policies and procedures Review vendor documentation Interview personnel Examine system configurations Are default passwords/passphrases on access points changed at installation? Review policies and procedures Interview personnel Examine system configurations
Is firmware on wireless devices updated to support strong encryption for authentication and transmission over wireless networks? Review policies and procedures Review vendor documentation Examine system configurations Are other security-related wireless vendor defaults changed, if applicable? Review policies and procedures Review vendor documentation Examine system configurations 2.2.2 Are only necessary services, protocols, daemons, etc. enabled as required for the function of the system (services and protocols not directly needed to perform the device’s specified function are disabled)? Review configuration standards Examine system configurations Are all enabled insecure services, daemons, or protocols justified per documented configuration standards? Review configuration standards Interview personnel Examine configuration settings Compare enabled services, etc. to documented justifications 2.2.3 Are additional security features documented and implemented for any required services, protocols or daemons that are considered to be insecure? Note: SSL/early TLS is used, the requirements in Appendix A2 must be completed. Review configuration standards Examine configuration settings 2.2.4 Are system administrators and/or personnel that configure system components knowledgeable common security parameter settings for those system components? Interview personnel Are common system security parameters settings included in the system configuration standards? Review system configuration standards
Protect Cardholder Data Requirement 3: Protect stored cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 3.2 (c) Is sensitive authentication data deleted or rendered unrecoverable upon completion of the authorization process? Review policies and procedures Examine system configurations Examine deletion processes (d) Do all systems adhere to the following requirements regarding non-storage of sensitive authentication data after authorization (even if encrypted): 3.2.2 The card verification code or (three-digit or number printed on the front or back of a payment card) is not stored after authorization? Examine data sources including: Incoming transaction data All logs History files Trace files Database schema Database contents 3.2.3 The personal identification number (PIN) or the encrypted PIN is not stored after authorization? Examine data sources including: Incoming transaction data All logs History files Trace files Database schema Database contents
(c) Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations (d) Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations (e) For TLS implementations, is TLS enabled whenever cardholder data is transmitted or received? For example, for browser-based implementations: “HTTPS” appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if appears as part of the URL. Examine system configurations 4.1.1 Are industry best practices used to implement strong encryption for authentication and transmission for wireless networks transmitting cardholder data or connected to the cardholder data environment? Review documented standards Review wireless networks Examine system configuration settings 4.2 Are policies in that state that unprotected PANs are not to be sent via end-user messaging technologies? Review policies and procedures Maintain a Vulnerability Management Program Requirement 5: Protect all systems against malware and regularly update software or programs PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 5.1 Is software deployed on all systems commonly affected by malicious software? Examine system configurations
5.1.1 Are programs capable of detecting, removing, and protecting against all known types of malicious software (for example, viruses, Trojans, worms, spyware, adware, and rootkits)? Review vendor documentation Examine system configurations 5.1.2 Are periodic evaluations performed to identify and evaluate evolving malware threats in to confirm whether those systems considered to not be commonly affected by malicious software continue as such? Interview personnel 5.2 Are all anti-virus mechanisms maintained as follows: Are all anti-virus software and definitions kept current? Examine policies and procedures Examine configurations, including the master installation Examine system components Are automatic updates and periodic scans enabled and being performed? Examine anti-virus configurations, including the master installation Examine system components Are all anti-virus mechanisms generating audit logs, and are logs retained in accordance with PCI DSS Requirement 10.7? Examine anti-virus configurations Review log retention processes 5.3 Are all anti-virus mechanisms: Actively running? Unable to be disabled or altered by users? Note: Anti-virus solutions may be temporarily disabled only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must be formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active. Examine anti-virus configurations Examine system components Observe processes Interview personnel
Requirement 8: Identify and authenticate access to system components PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 8.1.1 Are all users assigned a unique ID before allowing them to access system components or cardholder data? Review password procedures Interview personnel 8.1.3 Is access for any terminated users immediately deactivated or removed? Review password procedures Examine terminated users accounts Review current access Observe returned physical authentication devices 8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes 8.2.3 (a) Are user password parameters configured to require passwords/passphrases meet the following? A minimum password length of at least seven characters Contain both numeric and alphabetic characters Alternatively, the passwords/passphrases must have complexity and strength at least equivalent to the parameters specified above. Examine system configuration settings to verify password parameters
3 Protect stored cardholder data 4 Encrypt transmission of cardholder data across open, public networks 5 Protect all systems against malware and regularly update software or programs 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 8 Identify and authenticate access to system components 9 Restrict physical access to cardholder data 12 Maintain a policy that addresses information security for all personnel Appendix A2 Additional PCI DSS Requirements for Entities SSL/early TLS * PCI DSS Requirements indicated here refer to the questions in Section 2 of the SAQ.