PCI DSS Self-Assessment Completion Steps Identify the applicable SAQ for your environment – refer to the Self-Assessment Questionnaire Instructions and Guidelines document on PCI SSC website for information. Confirm that your environment is properly scoped and the eligibility criteria for the SAQ you are using (as defined in Part 2g of the Attestation of Compliance). Assess your environment for compliance with applicable PCI DSS requirements. Complete all sections of this document: Section 1 (Part 1 & 2 of the AOC) – Assessment Information and Executive Summary. Section 2 – PCI DSS Self-Assessment Questionnaire (SAQ A-EP) Section 3 (Parts 3 & 4 of the AOC) – Validation and Attestation Details and Action Plan for Non-Compliant Requirements (if applicable) Submit the SAQ and Attestation of Compliance, along with any other requested as ASV scan reports—to your acquirer, payment brand or other requester. Understanding the Self-Assessment Questionnaire The questions contained in the “PCI DSS Question” column in this self-assessment questionnaire are based on the requirements in the PCI DSS. Additional resources that provide guidance on PCI DSS requirements and how to complete the questionnaire have been provided to assist with the assessment process. An overview of some of these resources is provided below: Document Includes: PCI DSS (PCI Data Security Standard Requirements and Security Assessment Procedures) Guidance on Scoping Guidance on the intent of all PCI DSS Requirements Details of testing procedures Guidance on Compensating Controls SAQ Instructions and Guidelines documents Information about all SAQs and their eligibility criteria How to determine which SAQ is right for your organization PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms Descriptions and definitions of terms used in the PCI DSS and self-assessment questionnaires These and other resources can be found on the PCI SSC website (). Organizations are encouraged to review the PCI DSS and other supporting documents before beginning an assessment. Expected Testing The instructions provided in the “Expected Testing” column are based on the testing procedures in the PCI DSS, and provide a high-level description of the types of testing activities that should be performed in order to verify that a requirement has been met. Full details of testing procedures for each requirement can be found in the PCI DSS. such assessment
1.2 Do firewall and router configurations restrict connections between untrusted networks and any system in the cardholder data environment as follows: Note: An “untrusted network” is any network that is external to the networks belonging to the entity under review, and/or which is out of the entity’s ability to control or manage. 1.2.1 Is inbound and outbound traffic restricted to that which is necessary for the cardholder data environment? Review firewall and router configuration standards Examine firewall and router configurations Is all other inbound and outbound traffic specifically denied (for example by using an explicit “deny all” or an implicit deny after allow statement)? Review firewall and router configuration standards Examine firewall and router configurations 1.3.4 Are anti-spoofing measures implemented to detect and block forged sourced IP addresses from entering the network? (For example, block traffic originating from the internet with an internal address) Examine firewall and router configurations 1.3.5 Is outbound traffic from the cardholder data environment to the Internet explicitly authorized? Examine firewall and router configurations 1.3.6 Is stateful inspection, also as dynamic packet filtering, implemented—that is, only established connections are allowed into the network? Examine firewall and router configurations
1.3.8 Are methods in place to prevent the disclosure of private IP addresses and routing information to the Internet? Note: Methods to obscure IP addressing may include, but are not limited to: Network Address Translation (NAT) Placing servers containing cardholder data behind proxy servers/firewalls, Removal or filtering of advertisements for private networks that employ registered addressing, Internal use of RFC1918 address space instead of registered addresses. Examine firewall and router configurations Is any disclosure of private IP addresses and routing information to external entities authorized? Examine firewall and router configurations Interview personnel Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 2.1 Are vendor-supplied defaults always changed before installing a system on the network? This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP) community strings, etc.). Review policies and procedures Examine vendor documentation Observe system configurations and account settings Interview personnel
5.3 Are all anti-virus mechanisms: Actively running? Unable to be disabled or altered by users? Note: Anti-virus solutions may be temporarily disabled only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must be formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active. Examine anti-virus configurations Examine system components Observe processes Interview personnel Requirement 6: Develop and maintain secure systems and applications PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 6.1 Is a process to identify security vulnerabilities, including the following: Using reputable outside sources for vulnerability information? Assigning a risk ranking to vulnerabilities that includes identification of all “high” risk and “critical” vulnerabilities? Note: Risk rankings should be based on industry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score and/or the classification by the vendor, and/or type of systems affected. Review policies and procedures Interview personnel Observe processes
Requirement 11: Regularly test security systems and processes PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 11.2.2 Are quarterly external vulnerability scans performed? Note: Quarterly external vulnerability scans must be performed by an Approved Scanning Vendor (ASV), approved by the Payment Card Industry Security Standards Council (PCI SSC). Refer to the ASV Program Guide published on the PCI SSC website for scan customer responsibilities, scan preparation, etc. Review results from the four most recent quarters of external vulnerability scans Do external quarterly scan and rescan results satisfy the ASV Program Guide requirements for a passing scan (for example, no vulnerabilities rated 4.0 or higher by the CVSS, and no automatic failures)? Review results of each external quarterly scan and rescan Are quarterly external vulnerability scans performed by a PCI SSC Approved Scanning Vendor (ASV? Review results of each external quarterly scan and rescan 11.2.3 Are internal and external scans, and rescans as needed, performed after any significant change? Note: Scans must be performed by qualified personnel. Examine and correlate change control documentation and scan reports Does the scan process include rescans until: For external scans, no vulnerabilities exist that are scored 4.0 or higher by the CVSS; For internal scans, a passing result is obtained or all “high-risk” vulnerabilities as defined in PCI DSS Requirement 6.1 are resolved? Review scan reports Are scans performed by a qualified internal resource(s) or qualified external third party, and if applicable, does organizational independence of the tester exist (not required to be a QSA or ASV)? Interview personnel
3 Protect stored cardholder data 4 Encrypt transmission of cardholder data across open, public networks 5 Protect all systems against malware and regularly update software or programs 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 8 Identify and authenticate access to system components 9 Restrict physical access to cardholder data 10 and monitor all access to network resources and cardholder data 11 Regularly test security systems and processes 12 Maintain a policy that addresses information security for all personnel