Section 2: Self-Assessment Questionnaire B-IP Note: The following questions are numbered according to PCI DSS requirements and testing procedures, as defined in the PCI DSS Requirements and Security Assessment Procedures document. Self-assessment completion date: Build and Maintain a Secure Network Requirement 1: Install and maintain a firewall configuration to protect data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 1.1.2 Is there a current network diagram that documents all connections between the cardholder data environment and other networks, including any wireless networks? Review current network diagram Examine network configurations Is there a process to ensure the diagram is kept current? Interview responsible personnel 1.1.4 Is a firewall required and implemented at each Internet connection and between any demilitarized zone (DMZ) and the internal network zone? Review firewall configuration standards Observe network configurations to verify that a firewall(s) is in Is the current network diagram consistent with the firewall configuration standards? Compare firewall configuration standards to current network diagram 1.1.6 Do firewall and router configuration standards include a documented list of services, protocols, and ports, including business justification (for example, hypertext transfer protocol (HTTP), Secure Sockets Layer (SSL), Secure Shell (SSH), and Virtual Private Network (VPN) protocols)? Review firewall and router configuration standards
Are all insecure services, protocols, and ports identified, and are security features documented and implemented for each identified service? Note: Examples of insecure services, protocols, or include but are not limited to FTP, Telnet, POP3, IMAP, and SNMP. Review firewall and router configuration standards Examine firewall and router configurations 1.2 Do firewall and router configurations restrict connections between untrusted networks and any system in the cardholder data environment as follows: Note: An “untrusted network” is any network that is external to the networks belonging to the entity under review, and/or which is out of the entity’s ability to control or manage. 1.2.1 Is inbound and outbound traffic restricted to that which is necessary for the cardholder data environment? Review firewall and router configuration standards Examine firewall and router configurations Is all other inbound and outbound traffic specifically denied (for example by using an explicit “deny all” or an implicit deny after allow statement)? Review firewall and router configuration standards Examine firewall and router configurations 1.2.3 Are perimeter firewalls installed between all wireless networks and the cardholder data environment, and are these firewalls configured to deny or, if traffic is necessary for business purposes, permit only authorized traffic between the wireless environment and the cardholder data environment? Review firewall and router configuration standards Examine firewall and router configurations 1.3 Is direct public access prohibited between the Internet and any system component in the cardholder data environment, as follows: 1.3.3 Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment? Examine firewall and router configurations
Are unnecessary default accounts removed or disabled before installing a system on the network? Review policies and procedures Review vendor documentation Examine system configurations and account settings Interview personnel 2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data, are ALL wireless vendor defaults changed at installations, as follows: Are encryption keys changed from default at installation, and changed anytime anyone with knowledge of the keys leaves the company or changes positions? Review policies and procedures Review vendor documentation Interview personnel Are default SNMP community strings on wireless devices changed at installation? Review policies and procedures Review vendor documentation Interview personnel Examine system configurations Are default passwords/passphrases on access points changed at installation? Review policies and procedures Interview personnel Examine system configurations Is firmware on wireless devices updated to support strong encryption for authentication and transmission over wireless networks? Review policies and procedures Review vendor documentation Examine system configurations Are other security-related wireless vendor defaults changed, if applicable? Review policies and procedures Review vendor documentation Examine system configurations
2.3 Is non-console administrative access encrypted as follows: Use technologies such as SSH, VPN, or TLS for management and other non-console administrative access. Note: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Is all non-console administrative access encrypted with strong cryptography, and is a strong encryption method invoked before the administrator’s password is requested? Examine system components Examine system configurations Observe an administrator log on Are system services and parameter files configured to prevent the use of Telnet and other insecure remote login commands? Examine system components Examine services and files Is administrator access to web-based management interfaces encrypted with strong cryptography? Examine system components Observe an administrator log on For the technology in use, is strong cryptography implemented according to industry best practice and/or vendor recommendations? Examine system components Review vendor documentation Interview personnel
4.1 (a) Are strong cryptography and security protocols, such as TLS, SSH or IPSEC, used to safeguard sensitive cardholder data during transmission over open, public networks? Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Radio Service (GPRS). Note: SSL and TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Review documented standards Review policies and procedures Review all locations where CHD is transmitted or received Examine system configurations (b) Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations
ASV scans are being completed by the PCI SSC Approved Scanning Vendor (ASV Name) Part 3b. Merchant Attestation Signature of Merchant Executive Officer Date: Merchant Executive Officer Name: Part 3c. QSA Acknowledgement (if applicable) If a QSA was involved or assisted with this assessment, describe the role performed: Signature of Duly Authorized Officer of QSA Company Date: Duly Authorized Officer Name: QSA Company: Part 3d. ISA Acknowledgement (if applicable) If a ISA was involved or assisted with this assessment, describe the role performed: Signature of ISA Date: ISA Name: Title: Part 4. Action Plan for Non-Compliant Requirements Select the appropriate response for “Compliant to PCI DSS Requirements” for each requirement. If you answer “No” to any of the requirements, you may be required to provide the date your Company expects to be compliant with the requirement and a description of the actions being taken to meet the requirement. with your acquirer or the payment brand(s) before completing Part 4. PCI DSS Requirement* Description of Requirement Compliant to PCI DSS Requirements (Select One) Remediation Date and Actions (If “NO” selected for any Requirement) YES NO 1 Install and maintain a firewall configuration to protect cardholder data 2 Do not use vendor-supplied defaults for system passwords and other security parameters
3 Protect stored cardholder data 4 Encrypt transmission of cardholder data across open, public networks 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 8 Identify and authenticate access to system components 9 Restrict physical access to cardholder data 11 Regularly test security systems and processes 12 Maintain a policy that addresses information security for all personnel * PCI DSS Requirements indicated here refer to the questions in Section 2 of the SAQ.