Is firmware on wireless devices updated to support strong encryption for authentication and transmission over wireless networks? Review policies and procedures Review vendor documentation Examine system configurations Are other security-related wireless vendor defaults changed, if applicable? Review policies and procedures Review vendor documentation Examine system configurations 2.2.2 Are only necessary services, protocols, daemons, etc. enabled as required for the function of the system (services and protocols not directly needed to perform the device’s specified function are disabled)? Review configuration standards Examine system configurations Are all enabled insecure services, daemons, or protocols justified per documented configuration standards? Review configuration standards Interview personnel Examine configuration settings Compare enabled services, etc. to documented justifications 2.2.3 Are additional security features documented and implemented for any required services, protocols or daemons that are considered to be insecure? For example, use secured technologies such as SSH, SSL or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, FTP, etc. Review configuration standards Examine configuration settings 2.2.4 Are system administrators and/or personnel that configure system components knowledgeable about common security parameter settings for those system components? Interview personnel Are common system security parameters settings included in the system configuration standards? Review system configuration standards
Protect Cardholder Data Requirement 3: Protect stored cardholder data PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 3.2 (c) Is sensitive authentication data deleted or rendered unrecoverable upon completion of the authorization process? Review policies and procedures Examine system configurations Examine deletion processes (d) Do all systems adhere to the following requirements regarding non-storage of sensitive authentication data after authorization (even if encrypted): 3.2.2 The card verification code or value (three-digit or number printed on the front or back of a payment card) is not stored after authorization? Examine data sources including: Incoming transaction data All logs History files Trace files Database schema Database contents 3.2.3 The personal identification number (PIN) or the encrypted PIN block is not stored after authorization? Examine data sources including: Incoming transaction data All logs History files Trace files Database schema Database contents 3.3 Is the PAN masked when displayed (the first six and last four digits are the maximum number of digits to be displayed) such that only personnel with a legitimate business need can see the full PAN? Note: This requirement does not supersede stricter requirements in place for displays of cardholder example, legal or payment card brand requirements for point-of-sale (POS) receipts. Review policies and procedures Review roles that need access to displays of full PAN Examine system configurations Observe displays of PAN
Requirement 4: Encrypt transmission of cardholder data across open, public networks PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 4.1 Are strong cryptography and security protocols, such as SSL/TLS, SSH or IPSEC, used to safeguard sensitive cardholder data during transmission over open, public networks? Examples of open, public networks include but are not limited to the Internet; wireless technologies, including 802.11 and Bluetooth; cellular technologies, for example, Global System for Mobile communications (GSM), Code division multiple access (CDMA); and General Packet Service (GPRS). Review documented standards Review policies and procedures Review all locations where CHD is transmitted or received Examine system configurations Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations For SSL/TLS implementations, is SSL/TLS enabled whenever cardholder data is transmitted or received? For example, for browser-based implementations: “HTTPS” appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if “HTTPS” appears as part of the URL. Examine system configurations
Requirement 7: Restrict access to cardholder data by business need to know PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 7.1 Is access to system components and cardholder data limited to only individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: To least privileges necessary to perform job responsibilities? Assigned only to that specifically require that privileged access? Examine written access control policy Interview personnel Interview management Review privileged user IDs 7.1.3 Are access assigned based on individual personnel’s job classification and function? Examine written access control policy Interview management Review user IDs
3 Protect stored cardholder data 4 Encrypt transmission of cardholder data across open, public networks 5 Protect all systems against malware and regularly update software or programs 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 9 Restrict physical access to cardholder data 12 Maintain a policy that addresses information security for all personnel