1.3 Is direct public access prohibited between the Internet and any system component in the cardholder data environment, as follows: 1.3.3 Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment? Examine firewall and router configurations 1.3.5 Is outbound traffic from the cardholder data environment to the Internet explicitly authorized? Examine firewall and router configurations 1.3.6 Is stateful inspection, also known as dynamic packet filtering, implemented—that is, only established connections are allowed into the network? Examine firewall and router configurations 1.4 Is personal firewall software installed and active on any mobile and/or employee-owned devices that connect to the Internet when outside the network (for example, laptops used by employees), and which are also used to access the network? Review policies and configuration standards Examine mobile and/or devices Is the personal firewall software configured to specific configuration settings, actively running, and not alterable by of mobile and/or devices? Review policies and configuration standards Examine mobile and/or devices
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 2.1 Are vendor-supplied defaults always changed before installing a system on the network? This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP) community strings, etc.). Review policies and procedures Examine vendor documentation Observe system configurations and account settings Interview personnel Are unnecessary default accounts removed or disabled before installing a system on the network? Review policies and procedures Review vendor documentation Examine system configurations and account settings Interview personnel 2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data, are ALL wireless vendor defaults changed at installations, as follows: Are encryption keys changed from default at installation, and changed anytime anyone with knowledge of the keys leaves the company or changes positions? Review policies and procedures Review vendor documentation Interview personnel Are default SNMP community strings on wireless devices changed at installation? Review policies and procedures Review vendor documentation Interview personnel Examine system configurations Are default passwords/passphrases on access points changed at installation? Review policies and procedures Interview personnel Examine system configurations
Is firmware on wireless devices updated to support strong encryption for authentication and transmission over wireless networks? Review policies and procedures Review vendor documentation Examine system configurations Are other security-related wireless vendor defaults changed, if applicable? Review policies and procedures Review vendor documentation Examine system configurations 2.2.2 Are only necessary services, protocols, daemons, etc. enabled as required for the function of the system (services and protocols not directly needed to perform the device’s specified function are disabled)? Review configuration standards Examine system configurations Are all enabled insecure services, daemons, or protocols justified per documented configuration standards? Review configuration standards Interview personnel Examine configuration settings Compare enabled services, etc. to documented justifications 2.2.3 Are additional security features documented and implemented for any required services, protocols or daemons that are considered to be insecure? For example, use secured technologies such as SSH, SSL or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, FTP, etc. Review configuration standards Examine configuration settings 2.2.4 Are system administrators and/or personnel that configure system components knowledgeable about common security parameter settings for those system components? Interview personnel Are common system security parameters settings included in the system configuration standards? Review system configuration standards
4.1.1 Are industry best practices (for example, IEEE 802.11i) used to implement strong encryption for authentication and transmission for wireless networks transmitting cardholder data or connected to the cardholder data environment? Note: The use of WEP as a security control is prohibited. Review documented standards Review wireless networks Examine system configuration settings 4.2 Are policies in place that state that unprotected PANs are not to be sent via end-user messaging technologies? Review policies and procedures Maintain a Vulnerability Management Program Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 5.1 Is anti-virus software deployed on all systems commonly affected by malicious software? Examine system configurations 5.1.1 Are anti-virus programs capable of detecting, removing, and protecting against all known types of malicious software (for example, viruses, Trojans, worms, spyware, adware, and rootkits)? Review vendor documentation Examine system configurations 5.1.2 Are periodic evaluations performed to identify and evaluate evolving malware threats in order to confirm whether those systems considered to not be commonly affected by malicious software continue as such? Interview personnel 5.2 Are all anti-virus mechanisms maintained as follows:
Requirement 9: Restrict physical access to cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 9.5 Are all media physically secured (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes)? For purposes of Requirement 9, “media” refers to all paper and electronic media containing cardholder data. Review policies and procedures for physically securing media Interview personnel 9.6 Is strict control maintained over the internal or external distribution of any kind of media? Review policies and procedures for distribution of Do controls include the following: 9.6.1 Is media classified so the sensitivity of the data can be determined? Review policies and procedures for media classification Interview security personnel 9.6.2 Is sent by secured courier or other delivery method that can be accurately tracked? Interview personnel Examine media distribution tracking logs and documentation 9.6.3 Is management approval obtained to moving the media (especially when media is distributed to individuals)? Interview personnel Examine media distribution tracking logs and documentation 9.7 Is strict control maintained over the storage and accessibility of media? Review policies and procedures 9.8 Is all destroyed when it is no longer needed for business or legal reasons? Review periodic destruction policies and procedures (c) Is media destruction performed as follows: 9.8.1 Are hardcopy materials cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed? Review periodic media destruction policies and procedures Interview personnel Observe processes