Document Comparison

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

PCI DSS Question Expected Testing Response (Check one response for each question) CCW No N/A 2.1 (a) Are vendor-supplied defaults always changed before installing a system on the network? This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, payment applications, Simple Network Management Protocol (SNMP) community strings, etc.).

 Review policies and procedures  Examine vendor documentation  Observe system configurations and account settings  Interview personnel (b) Are unnecessary default accounts removed or disabled before installing a system on the network?  Review policies and procedures  Review vendor documentation  Examine system configurations and account settings  Interview personnel

Requirement 8: Identify and authenticate access to system components

PCI DSS Question Expected Testing Response (Check one response for each question) CCW No N/A 8.1.1 Are all users assigned a unique ID before allowing them to access system components or cardholder data?

 Review password procedures  Interview personnel 8.1.3 Is access for any terminated users immediately deactivated or removed?

 Review password procedures  Examine terminated users accounts  Review current access lists  Observe returned physical authentication devices In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users?

 Something you know, such as a password or passphrase  Something you have, such as a token device or smart card  Something you are, such as a biometric  Review password procedures  Observe authentication processes 8.2.3 (a) Are user password parameters configured to require passwords/passphrases meet the following?  A minimum …

PCI DSS Question Expected Testing Response (Check one response for each question) CCW No N/A 8.5 Are group, shared, or generic accounts, passwords, or other authentication methods prohibited as follows:

 Generic user IDs and accounts are disabled or removed;  Shared user IDs for system administration activities and other critical functions do not exist; and  Shared and generic user IDs are not used to administer any system components?  Review policies and procedures  Examine user ID lists  Interview personnel

 Observe processes  Review policies and procedures and supporting documentation 12.10.1 (a) Has an incident response plan been created to be implemented in the event of system breach?  Review the incident response plan  Review incident response plan procedures

Appendix A2: Additional PCI DSS Requirements for Entities using SSL/early TLS This appendix is not used for SAQ A merchant assessments Appendix A3: Designated Entities Supplemental Validation (DESV) This Appendix applies only to entities designated by a payment brand(s) or acquirer as requiring additional validation of existing PCI DSS requirements. Entities required to validate to this Appendix should use the DESV Supplemental Reporting Template and Supplemental Attestation of Compliance for reporting, and consult with the applicable payment brand and/or acquirer for submission procedures.

Section 3: Validation and Attestation Details Part 3. PCI DSS Validation This AOC is based on results noted in SAQ A (Section 2), dated (SAQ completion date).