Part 2f. Third-Party Service Providers Does your company use a Qualified Integrator & Reseller (QIR)? If Yes: Name of QIR Company: QIR Individual Name: Description of services provided by QIR: Yes No Does your company share cardholder data with any third-party service providers (for example, Qualified Integrator & Resellers (QIR), gateways, payment processors, payment service providers (PSP), web-hosting companies, airline booking agents, loyalty program agents, etc.)? Yes No If Yes: Name of service provider: Description of services provided: Note: Requirement 12.8 applies to all entities in this list. Part 2g. Eligibility to Complete SAQ B-IP Merchant certifies eligibility to complete this shortened version of the Self-Assessment Questionnaire because, for this payment channel: Merchant uses only standalone, PTS-approved point-of-interaction (POI) devices (excludes SCRs) connected via IP to merchant’s payment processor to take customers’ payment card information; The standalone IP-connected POI devices are validated to the PTS POI program as listed on the PCI SSC website (excludes SCRs); The standalone IP-connected POI devices are not connected to any other systems within the merchant environment (this can be achieved via network segmentation to isolate POI devices from other systems); The only transmission of cardholder data is from the PTS-approved POI devices to the payment processor; The POI device does not rely on any other device (e.g., computer, mobile phone, tablet, etc.) to connect to the payment processor; Merchant does not cardholder data in electronic format ; and If Merchant does store cardholder data, such data is only paper reports or copies of paper receipts and is not received electronically.
1.2 Do firewall and router configurations restrict connections between untrusted networks and any system in the cardholder data environment as follows: Note: An “untrusted network” is any network that is external to the networks belonging to the entity under review, and/or which is out of the entity’s ability to control or manage. 1.2.1 Is inbound and outbound traffic restricted to that which is necessary for the cardholder data environment? Review firewall and router configuration standards Examine firewall and router configurations Is all other inbound and outbound traffic specifically denied (for example by using an explicit “deny all” or an implicit deny after allow statement)? Review firewall and router configuration standards Examine firewall and router configurations 1.2.3 Are perimeter firewalls installed between all wireless networks and the cardholder data environment, and are these firewalls configured to deny or, if traffic is necessary for business purposes, permit only authorized traffic between the wireless environment and the cardholder data environment? Review firewall and router configuration standards Examine firewall and router configurations 1.3 Is direct public access prohibited between the Internet and any system component in the cardholder data environment, as follows: 1.3.3 Are anti-spoofing measures implemented to detect and block forged sourced IP addresses from entering the network? (For example, block traffic originating from the internet with an internal address) Examine firewall and router configurations 1.3.4 Is outbound traffic from the cardholder data environment to the Internet explicitly authorized? Examine firewall and router configurations
Is administrator access to web-based management interfaces encrypted with strong cryptography? Examine system components Observe an administrator log on For the technology in use, is strong cryptography implemented according to industry best practice and/or vendor recommendations? Examine system components Review vendor documentation Interview personnel Protect Cardholder Data Requirement 3: Protect stored cardholder data PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 3.2 (c) Is sensitive authentication data deleted or rendered unrecoverable upon completion of the authorization process? Review policies and procedures Examine system configurations Examine deletion processes (d) Do all systems adhere to the following requirements regarding non-storage of sensitive authentication data after authorization (even if encrypted):
8.3 Is all individual non-console administrative access and all remote access to the CDE secured using authentication, as follows: Note: Multi-factor authentication requires that a minimum of two of the three authentication methods (see PCI DSS Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered multi-factor authentication. 8.3.2 Is multi-factor authentication incorporated for all remote network access (both user and administrator, and including third party access for support and maintenance) originating from outside the entity’s network? Examine system configurations Observe personnel connecting remotely 8.5 Are group, shared, or generic accounts, passwords, or other authentication methods prohibited as follows: Generic user IDs and accounts are disabled or removed; Shared user IDs for system administration activities and other critical functions do not exist; and Shared and generic user IDs are not used to administer any system components Review policies and procedures Examine user ID lists Interview personnel Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question)
Yes Yes with CCW No N/A 9.1.2 Are physical and/or logical controls in place to restrict access to publicly accessible network jacks? For example, network located in public areas and areas accessible to visitors could be disabled and only enabled when network access is explicitly authorized. Alternatively, processes could be implemented to ensure that visitors are escorted at all times in areas with active network jacks. Review policies and procedures Interview personnel Observe locations 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing Interview personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of media Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for media classification Interview security personnel 9.6.2 Is media sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained prior to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.8 Is all media destroyed when it is no longer needed for business or legal reasons? Review periodic media destruction policies and procedures
(c) Is media destruction performed as follows: 9.8.1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Review periodic media destruction policies and procedures Interview personnel Observe processes Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents? Examine security of storage containers 9.9 Are devices that capture payment card data via direct physical interaction with the card protected against tampering and substitution as follows? Note: This requirement applies to card-reading devices used in card-present transactions (that is, card swipe or dip) at the point of sale. This requirement is not intended to apply to manual key-entry components such as computer keyboards and POS keypads. Do policies and procedures require that a list of such devices be maintained? Review policies and procedures Do policies and procedures require that devices are periodically inspected to look for tampering or substitution? Review policies and procedures Do policies and procedures require that personnel are trained to be aware of suspicious behavior and to report tampering or substitution of devices? Review policies and procedures 9.9.1 Does the list of devices include the following? Make, model of device Location of device (for example, the address of the site or facility the device is located) Device serial number or other method of unique identification Examine the list of devices Is the list accurate and up to date? Observe devices and device locations and compare to list