Document Changes Date PCI DSS Version SAQ Revision Description October 2008 1.2 To content with new PCI DSS v1.2 and to implement minor changes noted since original v1.1. October 2010 2.0 To align content with new PCI DSS v2.0 requirements and testing procedures. February 2014 3.0 To align content with PCI DSS v3.0 requirements and testing procedures and incorporate additional response options. April 2015 3.1 Updated to with PCI DSS v3.1. For details of PCI DSS changes, see PCI DSS – Summary of Changes from PCI DSS Version 3.0 to 3.1. July 2015 3.1 1.1 Updated to remove references to “best practices” prior to June 30, 2015. April 2016 3.2 1.0 Updated to align with PCI DSS v3.2. For details of PCI DSS changes, see PCI DSS – Summary of Changes from PCI DSS Version 3.1 to 3.2. of Contents
Note: Risk rankings should be on industry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score and/or the classification by the vendor, and/or type of systems affected. Methods for evaluating vulnerabilities and assigning risk ratings will vary based on an organization’s environment and risk strategy. Risk rankings should, at a minimum, identify all vulnerabilities considered to be a “high risk” to the environment. In addition to the risk ranking, vulnerabilities may be considered “critical” if they pose an imminent threat to the environment, impact critical systems, and/or would result in a potential compromise if not addressed. Examples of critical systems may include security systems, public-facing devices and systems, databases, and other systems that store, process or transmit cardholder data. 6.2 Are all system components and software protected from known vulnerabilities by installing applicable vendor-supplied security patches? Review policies and procedures Are critical security patches installed within one month of release? Note: Critical security patches should be identified according to the risk ranking process defined in Requirement 6.1. Review policies and procedures Examine system components Compare list of security patches installed to recent vendor patch lists 6.4.6 Upon completion of a significant change, are all relevant PCI DSS requirements implemented on all new or changed systems and networks, and documentation updated as applicable? Note: This requirement is a best practice until January 31, 2018, after which it becomes a requirement. Trace changes to change control documentation Examine change control documentation Interview personnel Observe affected systems or networks
9.1 Are appropriate facility controls in place to limit and monitor physical access to systems in the cardholder data environment? Observe physical access controls Observe personnel 9.1.1 (a) Are either video cameras or access-control mechanisms (or both) in place to monitor individual physical access to sensitive areas? Note: “Sensitive areas” refers to any data center, server room, or any area that houses systems that store, process, or transmit cardholder data. This excludes public-facing areas where only point-of-sale terminals are present such as the cashier areas in a retail store. Review policies and procedures Observe physical monitoring mechanisms Observe security features (b) Are either video cameras or access-control mechanisms (or both) protected from tampering or disabling? Observe processes Interview personnel (c) Is data collected from video cameras and/or access control mechanisms reviewed and correlated with other entries? Review policies and procedures Interview security personnel (d) Is data collected from video cameras and/or access control mechanisms stored for at least three months unless otherwise restricted by law? Review data retention processes Observe data storage Interview security personnel 9.1.2 Are physical and/or logical controls in place to restrict access to publicly accessible network jacks? For example, network jacks located in public areas and areas accessible to visitors could be disabled and only enabled when network access is explicitly authorized. Alternatively, processes could be implemented to ensure that visitors are escorted at all times in areas with active network jacks. Review policies and procedures Interview personnel Observe locations
If wireless scanning is utilized to identify authorized and unauthorized wireless access points, is the scan performed at quarterly for all system components and facilities? Examine output from recent wireless scans If automated monitoring is utilized (for example, wireless IDS/IPS, NAC, etc.), is monitoring configured to generate alerts to notify personnel? Examine configuration settings 11.1.1 Is an inventory of authorized wireless access points maintained and a business justification documented for all authorized wireless access points? Examine inventory records 11.1.2 Does the incident response plan define and require a response in the event that an unauthorized wireless access point is detected? Examine incident response plan (see Requirement 12.10) Is action taken when unauthorized wireless access points are found? Interview responsible personnel Inspect recent wireless scans and related responses
11.2.2 Are quarterly external vulnerability scans performed? Note: Quarterly external vulnerability scans must be performed by an Approved Scanning Vendor (ASV), approved by the Payment Card Industry Security Standards Council (PCI SSC). Refer to the ASV Program Guide published on the PCI SSC website for scan customer responsibilities, scan preparation, etc. Review results from the four most recent quarters of external vulnerability Do external quarterly scan and rescan results satisfy the ASV Program Guide requirements for a passing scan (for example, no vulnerabilities rated 4.0 or higher by the CVSS, and no automatic failures)? Review results of each external quarterly scan and rescan Are quarterly external vulnerability scans performed by a PCI SSC Approved Scanning Vendor (ASV? Review results of each external quarterly scan and rescan 11.2.3 Are internal and external scans, and rescans as needed, performed after any significant change? Note: must be performed by qualified personnel. Examine and correlate change control documentation and scan reports Does the scan process include rescans For external scans, no vulnerabilities exist that are scored 4.0 or higher by the CVSS, For internal scans, a passing result is obtained or all “high-risk” vulnerabilities as defined in PCI DSS Requirement 6.1 are resolved? Review scan reports Are scans performed by a qualified internal resource(s) or qualified external third party, and if applicable, does organizational independence of the tester exist (not required to be a QSA or ASV)? Interview personnel 11.3.4 If segmentation is used to isolate the CDE from networks: