Section 2: Self-Assessment Questionnaire A-EP Note: The following questions are numbered according to PCI DSS requirements and testing procedures, as defined in the PCI DSS Requirements and Security Assessment Procedures document. Self-assessment completion date: and Maintain a Secure Network Requirement 1: Install and maintain a firewall configuration to protect data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 1.1 Are firewall and router configuration standards established and implemented to include the following: 1.1.1 Is there a formal process for approving and testing all network connections and changes to the firewall and router configurations? Review documented process Interview personnel Examine network configurations 1.1.2 (a) Is there a current network diagram that documents all connections between the cardholder data environment and other networks, including any wireless networks? Review current network diagram Examine network configurations (b) Is there a process to ensure the diagram is kept current? Interview responsible personnel 1.1.3 (a) Is there a current diagram that shows all cardholder data flows across systems and networks? Review current dataflow diagram Examine network configurations. (b) Is there a process to ensure the diagram is kept current? Interview personnel 1.1.4 Is a firewall required and implemented at each Internet connection and between any demilitarized zone (DMZ) and the internal network zone? Review firewall configuration standards Observe network configurations to verify that a firewall(s) is in place
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 2.1 Are vendor-supplied defaults always changed before installing a system on the network? This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, payment applications, Simple Network Management Protocol (SNMP) community strings, etc.). Review policies and procedures Examine vendor documentation Observe system configurations and account settings Interview personnel Are unnecessary default accounts removed or disabled before installing a system on the network? Review policies and procedures Review vendor documentation Examine system configurations and account settings Interview personnel 2.2 Are configuration standards developed for all system components and are they consistent with system hardening standards? Sources of industry-accepted system hardening standards may include, but are not limited to, SysAdmin Audit Network Security (SANS) Institute, National Institute of Standards Technology (NIST), International Organization for Standardization (ISO), and Center for Internet Security (CIS). Review system configuration standards Review industry-accepted hardening standards Review policies and procedures Interview personnel Are system configuration standards updated as new vulnerability issues are identified, as defined in Requirement 6.1? Review policies and procedures Interview personnel Are system configuration standards applied when new systems are configured? Review policies and procedures Interview personnel
Requirement 8: Identify and authenticate access to system components PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 8.1 Are policies and procedures for user identification management controls defined and in place for users and administrators on all system components, as follows: 8.1.1 Are all users assigned a unique ID before allowing them to access system components or cardholder data? Review password procedures Interview personnel 8.1.2 Are additions, deletions, and modifications of user IDs, credentials, and identifier objects controlled such that user IDs are implemented only as authorized (including with specified privileges)? Review password procedures Examine privileged and general user IDs and associated authorizations Observe system settings 8.1.3 Is access for any terminated immediately deactivated or removed? Review password procedures Examine terminated users accounts Review current access lists Observe returned physical authentication devices 8.1.4 Are inactive user accounts either removed or disabled within 90 days? Review password procedures Observe user accounts 8.1.5 Are accounts used by third parties to access, support, or maintain system components via remote access enabled only during the time period needed and disabled when not in use? Review password procedures Interview personnel Observe processes Are third party remote access accounts monitored when in use? Interview personnel Observe processes 8.1.6 (a) Are repeated access attempts limited by locking out the user ID after no more than six attempts? Review password procedures Examine system configuration settings
9.8.1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Review periodic media destruction policies and procedures Interview personnel Observe processes Are storage containers used for materials that contain information to be destroyed secured to prevent access to the contents? Examine security of storage containers Regularly Monitor and Test Networks Requirement 10: Track and monitor all access to network resources and cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 10.1 Are audit trails enabled and active for system components? Observe processes Interview system administrator Is access to system components linked to individual users? Observe processes Interview system administrator 10.2 Are automated audit trails implemented for all system components to reconstruct the following events: 10.2.2 All actions by any individual with root or administrative privileges? Interview personnel Observe audit logs Examine audit log settings
3 Protect stored cardholder data 4 Encrypt transmission of cardholder data across open, public networks 5 Protect all systems against malware and regularly update software or programs 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 8 Identify and authenticate access to system components 9 Restrict physical access to cardholder data 10 Track and monitor all access to network resources and cardholder data 11 Regularly test security systems and processes 12 Maintain a policy that addresses information security for all personnel Appendix A2 Additional PCI DSS Requirements for Entities using SSL/early TLS * PCI DSS Requirements indicated here refer to the questions in Section 2 of the SAQ.