Document Diff - PCI Watch

Added p. 1

PCI DSS ROC Template Summary of Changes from ROC Template v4.0 to v4.0.1

Added p. 4

This summary is organized as follows:

 Summary of General Changes to ROC Template - includes descriptions of general changes made throughout.

 Summary of Specific Changes to ROC Template - includes descriptions of changes made for ROC Template Instructions, Part 1 Assessment Overview, and Part II Findings and Observations.

Added p. 4

Update language throughout to align with PCI DSS v4.0.1 Remove all pre-formatted text input fields.

Added p. 4

- Method(s) Used Add section to describe how to report the use of a compensating control or the customized approach.

Figure 1 Replace figure to reflect new requirement layout.

What is the Difference between Not Applicable and Not Tested? Clarify that both the ROC and AOC(s) must indicate which if any requirements were Not Applicable or Not Tested (formerly only the AOC(s) were cited).

Added p. 5

- Remove section and figure to reflect new reporting approach for compensating controls and customized approach.

Do’s and Don’ts: Reporting Expectations Add “Do” section bullets to:

• Provide a completed Appendix C for any requirements met with a compensating control.

• Provide a completed Appendix E for any requirements met with a customized approach.

• Read the PCI DSS Applicability Notes and Guidance for each requirement. Update a “Don’t” section bullet to clarify that, before copying responses from one requirement to another, the assessor confirms the response is fully applicable to each requirement.

PCI DSS v4.0.1 Report on Compliance Template Clarify that all instructional content from “this page and all preceding pages” may be deleted prior to finalizing the report.

PCI DSS Customizable cover page Update “Assessment End Date” to “Date Assessment Ended” to align with Section 1.2 Date and Timeframe of Assessment.

Part 1 Assessment Overview 1.1 Contact Information Under “Lead Qualified Security Assessor,” update “Assessor …

Added p. 5

- Remove section Optional: Additional Assessor comments.

- Remove section Attestation Signatures.

Added p. 6

Consolidate information about excluded business functions and services into section 3.1.

Added p. 6

Update “entity” to “merchant” to clarify that using SAQ eligibility criteria to determine applicability of PCI DSS requirements reported in a ROC is only applicable to merchants.

Added p. 6

- Remove section In Scope Business Functions.

Added p. 7

Remove column to identify all sub-requirements where the sample set was used.

Added p. 7

- 7 Findings and Observations Add header for section 7 Findings and Observations to account for move of section 6 into Part II.

Add an instruction that any use of a compensating control or the customized approach must include the corresponding documentation to support the method(s) used.

Modified p. 1 → 5

PCI DSS v4.0 Report on Compliance Template ~~Revision 1~~

PCI DSS v4.0 Report on Compliance Template

Removed p. 2

July 2014 PCI DSS 3.0, Revision 1.1 Errata - Minor edits made to address typos and general errors, slight addition of content.

Removed p. 2

December 2022 PCI DSS 4.0 Revision 1 Updates include minor clarifications, corrections to typographical errors, and removal of In Place with Remediation as a reporting option.

Removed p. 6

Use of this ROC Template is mandatory for all PCI DSS v4.0 submissions.

The tables in this template may be modified to increase/decrease the number of rows or to change the column width. Additional appendices may be added if the assessor feels there is relevant information to be included that is not addressed in the current format. However, the assessor must not remove any details from the tables provided in this document. Personalization, such as the addition of company logos to the title page below, is acceptable.

Do not delete any content from Part I or Part II of this document. The Instruction pages may be deleted; however, the assessor must follow these instructions while documenting the assessment. The addition of text or rows is acceptable, within reason, as noted above. Refer to the PCI DSS v4.x Report on Compliance Template - Frequently Asked Questions document on the PCI SSC website for …

Removed p. 7

• Section 4: Details about Reviewed Environment

• Section 5: Quarterly Scan Results

• Build and Maintain a Secure Network and Systems

• Protect Account Data

• Maintain a Vulnerability Management Program

• Implement Strong Access Control Measures

• Regularly Monitor and Test Networks

• Maintain an Information Security Policy

• Appendix A: Additional PCI DSS Requirements

• Appendix B: Compensating Controls

• Appendix C: Compensating Controls Worksheet

• Appendix D: Customized Approach

• Appendix E: Customized Approach Template Part I must be thoroughly and accurately completed to provide proper context for the assessment findings in Part II. The ROC Template includes tables with reporting instructions built-in to help assessors provide all required information throughout the document. Responses must be specific and focus on concise quality of detail, rather than lengthy, repeated verbiage. Use of template language for descriptions is discouraged and details must be specifically relevant to the assessed entity.

Modified p. 7 → 6

~~• Section 6: Evidence~~ (Assessment Workpapers)  Part ~~II: Findings and Observations~~

- Move section 6 Sampling (Assessment Workpapers) to Part II (see Part II below for details)

Removed p. 8

Refer to the following table when considering which selection to make. Only one assessment finding may be selected at the sub-requirement level and reporting associated with that assessment finding must be consistent across all required documents, including the AOC.

Refer to the PCI DSS v4.x Report on Compliance Template - Frequently Asked Questions document on the PCI SSC website for further guidance.

Assessment When to Use This Assessment Finding Using Figure 1 Required Reporting In Place The expected testing has been performed, and all elements of the requirement have been met.

In Figure 1, the Assessment Finding at 1.1.1 is In Place if all report findings are In Place for 1.1.1.a and 1.1.1.b or a combination of In Place and Not Applicable.

Describe how the testing and evidence demonstrates the requirement is In Place.

Not Applicable The requirement does not apply to the organization’s environment. Not Applicable responses require reporting on testing performed to confirm …

Removed p. 9

In Figure 1, the Assessment Finding at 1.1.1 is Not Tested if either 1.1.1.a or 1.1.1.b are concluded to be Not Tested.

Describe why this requirement was excluded from the assessment.

Not in Place Some or all elements of the requirement have not been met, are in the process of being implemented, or require further testing before it will be known if they are In Place. This response is also used if a requirement cannot be met due to a legal restriction, meaning that meeting the requirement would contravene a local or regional law or regulation. The assessor must confirm that a statutory law or regulation exists that prohibits the requirement from being met. Note: Contractual obligations or legal advice are not legal restrictions.

In Figure 1, the Assessment Finding at 1.1.1 is Not in Place if either 1.1.1.a or 1.1.1.b are concluded to be Not in Place.

Describe how the testing and evidence …

Removed p. 10

Figure 1. Example Requirement Requirement Description 1.1 Example Requirement Description

PCI DSS Requirement 1.1.1 Example Requirement Assessment Findings (select one) In Place Not Applicable Not Tested Not in Place Describe why the assessment finding was selected.

Note: Include all details as noted in the “Required Reporting” column of the table in Assessment Findings in the ROC Template Instructions.

Removed p. 10

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.1.1.a Example testing procedure Example reporting instruction <Enter Response Here> 1.1.1.b Example testing procedure Example reporting instruction <Enter Response Here>

Removed p. 11

If a requirement is completely excluded from review without any consideration as to whether it could apply, the Not Tested option must be selected. Examples of situations where this could occur may include:

 An organization may be asked by their acquirer or brand to validate a subset of requirements•for example, using the prioritized approach to validate certain milestones.

 An organization may want to validate a new security control that impacts only a subset of requirements•for example, implementation of a new encryption method that requires assessment of PCI DSS Requirements 2, 3, and 4.

 A service provider organization might offer a service that covers only a limited number of PCI DSS requirements•for example, a physical storage provider may want only to validate the physical security controls per PCI DSS Requirement 9 for their storage facility.

In these scenarios, the organization wants only to validate certain PCI DSS requirements, even though other requirements …

Removed p. 12

Assessor verified this is the responsibility of Service Provider X, as verified through review of x/y contract (document). Assessor reviewed the AOC for Service Provider X, dated YYYY-MM-DD, and confirmed the service provider was found to be PCI DSS compliant against PCI DSS vX.X for all applicable requirements, and that it covers the scope of the services used by the assessed entity.

That response could vary, but what’s important is that it is noted as In Place, and that there has been a level of testing by the assessor to support the conclusion that this responsibility is verified and that the responsible party has been tested against the requirement and found to be compliant.

Removed p. 13

Assessment When to Use This Approach Using Figure 2 Customized Approach Focuses on the Customized Approach Objective of each PCI DSS Requirement (if applicable), allowing entities to implement controls to meet the requirement’s stated Customized Approach Objective in a way that does not strictly follow the defined requirement. The customized approach supports innovation in security practices, allowing entities greater flexibility to show how their current security controls meet PCI DSS requirements. Refer to the Payment Card Industry Data Security Standard (PCI DSS) Requirements and Testing Procedures for the Customized Approach Objective. Note: Compensating Controls are not an option for the Customized Approach For “Validation Method

• Customized Approach”

• If the Customized Approach is not used, select “No” for Customized Approach acknowledgement check box, and mark the relevant reporting instruction as Not Applicable.

• If the Customized Approach is used, complete the following: o Select “Yes” for Customized Approach acknowledgement check box. o …

Removed p. 14

Figure 2. Assessment Approach Reporting Options Validation Method

• Customized Approach Indicate whether a Customized Approach was used: ☐ Yes ☐ No If “Yes”, Identify the aspect(s) of the requirement where the Customized Approach was used. Note: The use of Customized Approach must also be documented in Appendix E.

Removed p. 15

Assessor responses generally fall into categories, such as the following:

Reporting Instruction Term Example Usage Description of Response Indicate Indicate whether the assessed entity is an issuer or supports issuing services.

The response would be either “Yes” or “No” as shown:

Note: The applicability of some reporting instructions may be dependent on the response of a previous reporting instruction. If applicable, the reporting instruction will direct the assessor to a subsequent instruction based on the yes/no answer.

Identify Identify the evidence reference number(s) from Section 6 for all documentation examined for this testing procedure.

The response would include the relevant item(s) requested. Example Reporting Instruction: “Identify the evidence reference number(s) from Section 6 for all documentation examined for this testing procedure.” Example Response: Doc-01 OR Doc-01 (Company XYZ Information Security Policy) Note: When a reference number is available, it is required; however, the assessor also has the option to list individual items in addition to …

Removed p. 16

• Use this Reporting Template when assessing against v4.0 of the PCI DSS.

• Read and understand the intent of each Requirement and Testing Procedure.

• Provide a response for every Testing Procedure.

• Provide sufficient detail and information to thoroughly document the assessment.

• Ensure sufficient detail and information are included in the workpaper evidence.

• Ensure all parts of the Testing Procedure and Reporting Instruction are addressed.

• Ensure the response covers all applicable system components, business functions, or facilities.

• Perform an internal quality assurance review of the ROC for clarity, accuracy, and quality.

• Provide useful, meaningful diagrams as directed.

• Don’t select the In Place response without verification that the requirement is met (plans to meet a requirement in the future do not warrant an In Place response)

• Don’t copy responses from one Testing Procedure to another.

• Don’t copy responses from previous assessments.

• Don’t include information irrelevant to the assessment.

• Don’t leave any spaces …

Removed p. 17

PCI DSS v4.0 Report on Compliance Entity Name:

Removed p. 19

<Enter Response Here> <Enter Response Here> Identify all other assessors involved in the assessment. If there were none, mark as Not Applicable. (Add rows as needed) Assessor name: Assessor PCI credentials: (QSA, Secure Software Assessor, etc.) <Enter Response Here> <Enter Response Here> Assessor Quality Assurance (QA) Primary Reviewer for this specific report (not the general QA contact for the QSA Company) QA reviewer name: <Enter Response Here> QA reviewer phone number: <Enter Response Here> QA reviewer e-mail address: <Enter Response Here> QA Reviewer’s PCI Credentials: (See the current QSA Qualification Requirements for acceptable credentials) <Enter Response Here>

Removed p. 20

<Enter Response Here> Date assessment began: Note: This is the first date that evidence was gathered, or observations were made.

<Enter Response Here> Date assessment ended: Note: This is the last date that evidence was gathered, or observations were made.

<Enter Response Here> Identify the date(s) spent onsite at the assessed entity.

<Enter Response Here> 1.3 Remote Assessment Activities Overview of Remote Testing Activity To what extent were remote testing methods used for this assessment? ☐ All testing was performed onsite ☐ A combination of onsite and remote testing methods was used ☐ All testing was performed remotely If remote testing was used for any part of the assessment, briefly describe why onsite testing was not feasible or practical.

Removed p. 21

Describe the methods used to perform the remote testing.

Describe any alternative and any additional testing activities that were performed to confirm assurance in the test result.

Examine documentation ☐ Yes ☐ No <Enter Response Here> <Enter Response Here> Interview personnel ☐ Yes ☐ No <Enter Response Here> <Enter Response Here> Examine/observe live data ☐ Yes ☐ No <Enter Response Here> <Enter Response Here> Observe process being performed ☐ Yes ☐ No <Enter Response Here> <Enter Response Here> Observe physical environment ☐ Yes ☐ No <Enter Response Here> <Enter Response Here> Interactive testing ☐ Yes ☐ No <Enter Response Here> <Enter Response Here> Assessor Assurance in Assessment Result If remote testing methods were used for the assessment, identify whether the assessor was able to:

Complete a thorough assessment using appropriate remote testing activities as described in QSA Program Guide? ☐ Yes ☐ No Achieve a high degree of confidence that the assessment resulted …

Removed p. 22

☐ Yes ☐ No Requirement number Was any testing able to be completed for this requirement? Describe what (if any) aspects of the requirement could be verified Describe what aspects of the requirement could not be verified <Enter Response Here> ☐ Yes ☐ No <Enter Response Here> <Enter Response Here> <Enter Response Here> ☐ Yes ☐ No <Enter Response Here> <Enter Response Here> <Enter Response Here> ☐ Yes ☐ No <Enter Response Here> <Enter Response Here> 1.4 Additional Services Provided by QSA Company The PCI SSC Qualification Requirements for Qualified Security Assessors (QSA) includes content on “Independence,” which specifies requirements for assessor disclosure of services and/or offerings that could reasonably be viewed to affect the independence of assessment. Complete the section below after reviewing the relevant portions of the Qualification Requirements to ensure responses are consistent with documented obligations.

Indicate whether the QSA Company provided any consultation on the development or …

Removed p. 23

☐ Yes ☐ No If yes, identify the Assessor Company(s) utilized during the assessment. <Enter Response Here> 1.6 Additional Information/Reporting Identify the number of consecutive years (including the current year) the QSA Company has issued ROCs for this entity.

<Enter Response Here> 1.7 Overall Assessment Result Indicate below whether a full or partial assessment was completed. Select only one.

☐ Full Assessment: All requirements have been assessed and therefore no requirements were marked as Not Tested.

☐ Partial Assessment: One or more requirements have not been assessed and were therefore marked as Not Tested. Any requirement not assessed is noted as Not Tested in section 1.8.1 below.

Overall Assessment Result (Select only one) Compliant: All sections of the PCI DSS ROC are complete, and all assessed requirements are marked as being either In Place or Not Applicable, resulting in an overall COMPLIANT rating; thereby the assessed entity has demonstrated compliance with all PCI DSS …

Removed p. 24

PCI DSS Requirement Assessment Finding Select all options that apply.

Select If Below Method(s) Was In Place Not Applicable Not Tested Not in Place Compensating Customized

Removed p. 25

Not Applicable Not Tested Not in Place Due to a Legal Restriction Not in Place Not Due to a Legal Restriction Compensating Customized <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> Optional: Additional Assessor Comments This optional field is provided for the assessor to document any additional information that is relevant to the entity being assessed and that may or may not have impacted the findings of this assessment.

Removed p. 26

• This assessment was conducted strictly in accordance with all applicable requirements set forth in the Payment Card Industry Data Security Standard Qualification Requirements for Assessors, including but not limited to the requirements therein regarding independence, independent judgment and objectivity, disclosure, conflicts of interest, misrepresentations, and instruction of employees;

• This assessment was conducted in a manner intended to preserve at all times the professional judgment, integrity, impartiality, and professional skepticism of the Assessor Company;

• This Report on Compliance accurately identifies, describes, represents, and characterizes all factual evidence that the QSA Company and its Assessor Employees gathered, generated, discovered, reviewed, and/or determined in their sole discretion to be relevant to this assessment in the course of performing the assessment; and

• The judgments, conclusions, and findings contained in this Report on Compliance (a) accurately reflect and are based solely upon the factual evidence described immediately above, (b) reflect the independent judgments, findings, …

Removed p. 27

Describe the nature of the entity’s business (what kind of work they do, etc.). Note: This is not intended to be a cut-and-paste from the entity’s website but should be a tailored description that shows the assessor understands the business of the entity being assessed.

<Enter Response Here> Identify any of the entity’s businesses services or functions that have been excluded from the scope of this assessment.

<Enter Response Here> Identify the card-present payment channels the entity utilizes. <Enter Response Here> Identify the card-not-present payment channels the entity utilizes. (For example, mail order/telephone order [MOTO], e-commerce) <Enter Response Here> Describe how the entity stores, processes, and/or transmits account data.

<Enter Response Here> Describe how any other in-scope services or functions that the entity performs impact the security of account data. (For example, if the entity provides managed services) <Enter Response Here> Indicate whether any payment channels or services that impact the security of …

Modified p. 27 → 6

~~<Enter Response Here> Describe~~ the ~~entity’s business,~~ services, or functions that ~~store,~~ process, or transmit account data or could impact the security of account data.

Add a section to separate the description of businesses, services, or functions that store process, or transmit account data from those that could impact the security of account data.

Removed p. 28

As noted in Payment Card Industry Data Security Standard (PCI DSS) Requirements and Testing Procedures: “The minimum steps for an entity to confirm the accuracy of their PCI DSS scope are specified in PCI DSS Requirement 12.5.2. The entity is expected to retain documentation to show how PCI DSS scope was determined. The documentation is retained for assessor review and for reference during the entity’s next PCI DSS scope confirmation activity. For each PCI DSS assessment, the assessor validates that the scope of the assessment is accurately defined and documented.” Describe how the assessor’s evaluation of scope differs from the assessed entity’s evaluation of scope as documented in Requirement 12.5. If no difference was identified, mark as “Not Applicable.” <Enter Response Here> Provide the name of the assessor who attests that:

• They have performed an independent evaluation of the scope of the assessed entity’s PCI DSS environment.

• If the assessor’s …

Removed p. 29

• The type of SAQ applied.

• The eligibility criteria for the applicable SAQ.

• How the assessor verified that the assessed entity’s environment meets the eligibility criteria. If not used mark as “Not Applicable.” <Enter Response Here> Additional information, if applicable: <Enter Response Here> 3.2 Segmentation Indicate whether the assessed entity has used segmentation to reduce the scope of the assessment. Note: An environment with no segmentation is considered a “flat” network where all systems are considered to be in scope.

• If “No,” provide the name of the assessor who attests that the entire network has been included in the scope of the assessment.

• If “Yes,” complete the following:

• Describe how the segmentation is implemented, including the technologies and processes used.

• Describe the environments that were confirmed to be out of scope as a result of the segmentation methods.

• Provide the name of the assessor who attests that the segmentation was …

Removed p. 30

☐ Yes ☐ No If “Yes,” provide the following information regarding items the organization uses from PCI SSC's Lists of Validated Products and Solutions:

Name of PCI SSC validated product or Version of product or

PCI SSC Standard to which product or solution was validated

PCI SSC listing reference number Expiry date of listing <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> Provide the name of the assessor who attests that they have read the instruction manual associated with each of the software/solution(s) listed above and confirmed that the merchant has implemented the solution per the instructions and detail in the instruction manual.

<Enter Response Here> Any additional comments or findings the assessor would like to include, if applicable.

Removed p. 31

• If “No,” provide the name of the assessor who attests that every item in each population has been assessed.

• If “Yes,” complete the following: Note: If multiple sampling methodologies are used, clearly respond for each methodology.

• Describe the sampling rationale(s) used for selecting sample sizes (for people, process evidence, technologies, devices, locations/sites, etc.).

• Describe how the samples are appropriate and representative of the overall populations.

• Indicate whether standardized processes and controls are in place that provide consistency between each item in the samples

•for example, automated system build processes, configuration change detection, etc.

☐ Yes ☐ No o If “Yes,” describe how the processes and controls were validated by the assessor to be in place and effective.

Removed p. 32

 Shows all connections between the CDE and other networks, including any wireless networks.

 Is accurate and up to date with any changes to the environment.

 Illustrates all network security controls that are defined for connection points between trusted and untrusted networks.

 Illustrates how system components storing cardholder data are not directly accessible from the untrusted networks.

 Includes the techniques (such as intrusion-detection systems and/or intrusion-prevention systems) that are in place to monitor all traffic:

• At the perimeter of the cardholder data environment.

• At critical points in the cardholder data environment.

Removed p. 33

 Shows all account data flows across systems and networks.

 Are accurate and up to date.

Description of Account Data Flows Identify in which of the following account data flows the assessed entity participates: Note: These data flows must be described in detail in the sections of the table that follow.

☐ Authorization ☐ Capture ☐ Settlement ☐ Chargeback/Dispute ☐ Refunds ☐ Other Identify and describe all data flows. Descriptions should include how and where account data enters the environment, is transmitted, is processed, is stored, and how and why any personnel access the account data. Add rows as necessary.

Account data flows (For example, account data flow 1, account data flow 2) Description (Include the type of account data) <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> Insert Diagrams

Removed p. 34

Note: The list of files and tables that store account data in the table below must be supported by an inventory created (or obtained from the assessed entity) and retained by the assessor in the workpapers.

Data Store1 File name(s), Table names(s) and/or Field Names Account Data Elements Stored2 How Data Is Secured3 How Access to Data Stores Is <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> 1 Database name, file server name, and so on. 2 For example, PAN, expiry, cardholder name, and so on. 3 For example, what type of encryption and strength. 4 Description of logging …

Removed p. 35

Note: The list of files and tables that store SAD in the table below must be supported by an inventory created (or obtained from the assessed entity) and retained by the assessor in the workpapers.

Data Store1 File name(s), Table names(s) and/or Field Names Is SAD Stored Pre- authorization?

Is SAD Stored as Part of Issuer Functions? How Data Is Secured2 <Enter Response Here> <Enter Response Here> ☐ Yes <Enter Response Here> <Enter Response Here> <Enter Response Here> ☐ Yes <Enter Response Here> <Enter Response Here> <Enter Response Here> ☐ Yes <Enter Response Here> <Enter Response Here> <Enter Response Here> ☐ Yes <Enter Response Here> 1 Database name, file server name, and so on. 2 For example, what type of encryption and strength, and so on.

Removed p. 35

 Store, process, or transmit account data on the entity’s behalf (for example, payment gateways, payment processors, payment service providers [PSPs])  Manage system components included in the entity’s PCI DSS assessment (for example, via network security control services, anti- malware services, security incident and event management [SIEM], web-hosting companies, IaaS, PaaS, SaaS, FaaS, etc.)  Could impact the security of the entity’s account data (for example, vendors providing support via remote access, and/or bespoke software developers).

These entities are subject to PCI DSS Requirement 12.8.

Removed p. 36

Company Name Identify what account data is shared or, if account data is not shared, how the organization could impact the security of account data1 Describe the purpose for utilizing the service provider2 Has the third party been assessed separately against PCI DSS? If Yes, identify the date and PCI DSS version of the AOC.

If No, were the services provided by the third party included in this assessment? Yes No Date Version Yes No <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> 1 …

Removed p. 37

Note: This section must align with networks identified on the network diagram.

Describe all networks that store, process, and/or transmit Account Data:

Network Name (In scope) Type of Network Function/ Purpose of Network <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> Describe all networks that do not store, process, and/or transmit Account Data but are still in scope•for example, connected to the CDE or provide management functions to the CDE, etc.:

Network Name (In Scope) Type of Network Function/Purpose of Network <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> 4.6 In-scope Locations/Facilities Identify and provide details for all types of physical locations/facilities (for example, retail locations, …

Removed p. 38

Function Name Function Description <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> 4.8 In-scope System Component Types Identify all types of system components in scope.

“System components” include network devices, servers, computing devices, virtual components, cloud components, and software. Examples of system components include, but are not limited to:

 Systems that store, process, or transmit account data (for example, payment terminals, authorization systems, clearing systems, payment middleware systems, payment back-office systems, shopping cart and store front systems, payment gateway/switch systems, fraud monitoring systems).

Removed p. 39

 Systems that facilitate segmentation (for example, internal network security controls).

 Systems that could impact the security of account data or the CDE (for example, name resolution, or e-commerce [web] redirection servers).

 Virtualization components such as virtual machines, virtual switches/routers, virtual appliances, virtual applications/desktops, and hypervisors.

 Cloud infrastructure and components, both external and on premises, and including instantiations of containers or images, virtual private clouds, cloud-based identity and access management, CDEs residing on premises or in the cloud, service meshes with containerized applications, and container orchestration tools.

 Network components, including but not limited to network security controls, switches, routers, VoIP network devices, wireless access points, network appliances, and other security appliances.

 Server types, including but not limited to web, application, database, authentication, mail, proxy, Network Time Protocol (NTP), and Domain Name System (DNS).

 End-user devices, such as computers, laptops, workstations, administrative workstations, tablets, and mobile devices.

 Printers, and multi-function devices …

Removed p. 41

When sampling is used the assessor must identify the items in the population that were tested (for example, as “Sample Set-1”) as part of the sample in the table below and include all of the sub-requirements where that sample set was used. All unique sample sets must be documented in this table.

Note: For items where the total population fluctuates or is difficult to determine, the assessor may work with the assessed entity to provide an estimated total population in the total population column below.

Tested Sample Set Reference Identify All Sub- Requirements Where the Sample Set is Sample Type/ Description1 Identify All Items in the Sample Set2 Selection Method3 Total Sampled Total Population <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response …

Removed p. 42

It is not required that four passing quarterly scans must be completed for initial PCI DSS compliance if the assessor verified:

 The most recent scan result was a passing scan,  The entity has documented policies and procedures requiring quarterly scanning going forward, and  Any vulnerabilities noted in the initial scan have been corrected as shown in a re-scan.

For subsequent years after the initial PCI DSS assessment, four passing quarterly scans must have occurred.

Date of the Scan(s) Name of ASV that Performed the Scan Were any vulnerabilities found that resulted in a failed initial scan? For all scans resulting in a Fail, provide date(s) of re- scans showing that the vulnerabilities have been corrected Yes No <Enter Response Here> <Enter Response Here> ☐ ☐ <Enter Response Here> <Enter Response Here> <Enter Response Here> ☐ ☐ <Enter Response Here> <Enter Response Here> <Enter Response Here> ☐ ☐ <Enter Response Here> …

Removed p. 43

 The entity has documented policies and procedures requiring quarterly scanning going forward, and  Any vulnerabilities noted in the initial scan have been corrected as shown in a re-scan.

For subsequent years after the initial PCI DSS review, four passing quarterly scans must have occurred.

Date of the Scan(s) Was the scan performed via authenticated scanning?

Were any high-risk or critical vulnerabilities per the entity’s vulnerability risk rankings at Requirement 6.3.1 found? For all scans where high-risk or critical vulnerabilities were found, provide date(s) of re-scans showing that the vulnerabilities have been corrected.

Yes No Yes No <Enter Response Here> ☐ ☐ ☐ ☐ <Enter Response Here> <Enter Response Here> ☐ ☐ ☐ ☐ <Enter Response Here> <Enter Response Here> ☐ ☐ ☐ ☐ <Enter Response Here> <Enter Response Here> ☐ ☐ ☐ ☐ <Enter Response Here> Indicate if this is the assessed entity’s initial PCI DSS compliance validation ☐ Yes ☐ No …

Removed p. 44

<Enter Response Here> Identify the entity or entities who controls the evidence repositories. <Enter Response Here> Indicate whether the entity or entities in control of the evidence repositories understands that all evidence from this assessment must be maintained for a minimum of 3 years and must be made available to PCI SSC upon request.

☐ Yes ☐ No 6.2 Documentation Evidence Identify all evidence for any testing procedure requiring a review of documents such as policies, procedures, standards, records, inventories, vendor documentation, and diagrams. Include the following: (Add rows as needed) Reference Number Document Name (including version, if applicable) Brief Description of Document Document Revision Date (if applicable) EXAMPLE: Doc-1 Company XPY Information Security Policy Information Security Policy 2021-02-18 <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response …

Removed p. 45

Information Security Manager <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> 6.4 Observation Evidence Identify all evidence for testing procedures requiring an observation, such as observation notes for observed processes. Include the following: (Add rows as needed) Reference Number Title of Workpaper with Observation Notes Observed Process Brief Description of the EXAMPLE: Proc-1 Assessor notes from observation of visitor badge processes Visitor Badge Process Process for allocating and collecting/expiring visitor badges <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> <Enter Response Here> …

Removed p. 47

Requirement 1: Install and Maintain Network Security Controls Requirement Description 1.1 Processes and mechanisms for installing and maintaining network security controls are defined and understood.

Removed p. 50

<Enter Response Here> 1.1.2.b Interview personnel responsible for performing activities in Requirement 1 to verify that roles and responsibilities are assigned as documented and are understood.

Removed p. 51

PCI DSS Requirement 1.2.1 Configuration standards for NSC rulesets are:

Removed p. 52

<Enter Response Here> 1.2.1.b Examine configuration settings for NSC rulesets to verify that rulesets are implemented according to the configuration standards.

Removed p. 52

PCI DSS Requirement 1.2.2 All changes to network connections and to configurations of NSCs are approved and managed in accordance with the change control process defined at Requirement 6.5.1.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.2.2.a Examine documented procedures to verify that changes to network connections and configurations of NSCs are included in the formal change control process in accordance with Requirement 6.5.1.

Removed p. 53

<Enter Response Here> 1.2.2.b Examine network configuration settings to identify changes made to network connections. Interview responsible personnel and examine change control records to verify that identified changes to network connections were approved and managed in accordance with Requirement 6.5.1.

Identify the evidence reference number(s) from Section 6 for all network configuration settings examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all change control records examined for this testing procedure.

Identify the evidence reference number(s) from Section 6 for all network configuration settings examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all change control records examined for this testing procedure.

Removed p. 54

PCI DSS Requirement 1.2.3 An accurate network diagram(s) is maintained that shows all connections between the CDE and other networks, including any wireless networks.

Removed p. 55

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.2.3.a Examine diagram(s) and network configurations to verify that an accurate network diagram(s) exists in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all diagrams examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all network configurations examined for this testing procedure.

<Enter Response Here> 1.2.3.b Examine documentation and interview responsible personnel to verify that the network diagram(s) is accurate and updated when there are changes to the environment.

PCI DSS Requirement 1.2.4 An accurate data-flow diagram(s) is maintained that meets the following:

• Shows all account data flows across systems and networks.

• Updated as needed upon changes to the environment.

Removed p. 56

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.2.4.a Examine data-flow diagram(s) and interview personnel to verify the diagram(s) show all account data flows in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all data-flow diagram(s) examined for this testing procedure.

<Enter Response Here> 1.2.4.b Examine documentation and interview responsible personnel to verify that the data-flow diagram(s) is accurate and updated when there are changes to the environment.

PCI DSS Requirement 1.2.5 All services, protocols, and ports allowed are identified, approved, and have a defined business need.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.2.5.a Examine documentation to verify that a list exists of all allowed services, protocols, and ports, including business justification and approval for each.

<Enter Response Here> 1.2.5.b Examine configuration settings for NSCs to verify that only approved services, protocols, and ports are in use.

PCI DSS …

Removed p. 60

<Enter Response Here> 1.2.6.b Examine configuration settings for NSCs to verify that the defined security features are implemented for each identified insecure service, protocol, and port.

PCI DSS Requirement 1.2.7 Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.2.7.a Examine documentation to verify procedures are defined for reviewing configurations of NSCs at least once every six months.

<Enter Response Here> 1.2.7.b Examine documentation of reviews of configurations for NSCs and interview responsible personnel to verify that reviews occur at least once every six months.

<Enter Response Here> 1.2.7.c Examine configurations for NSCs to verify that configurations identified as no longer being supported by a business justification are removed or updated.

Removed p. 62

PCI DSS Requirement 1.2.8 Configuration files for NSCs are:

• Secured from unauthorized access.

• Kept consistent with active network configurations.

Removed p. 63

Identify the evidence reference number(s) from Section 6 for all configuration files examined for this testing procedure.

<Enter Response Here> Requirement Description 1.3 Network access to and from the cardholder data environment is restricted.

PCI DSS Requirement 1.3.1 Inbound traffic to the CDE is restricted as follows:

• To only traffic that is necessary.

• All other traffic is specifically denied.

Modified p. 63 → 7

~~<Enter Response Here>~~ Validation Method

• Customized Approach ~~Indicate whether a Customized Approach was used: ☐ Yes ☐ No~~

Requirement Layout Remove Validation Method- Customized Approach reporting rows and add checkbox to note the use of the customized approach.

Removed p. 64

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.3.1.a Examine configuration standards for NSCs to verify that they define restricting inbound traffic to the CDE is in accordance with all elements specified in this requirement.

<Enter Response Here> 1.3.1.b Examine configurations of NSCs to verify that inbound traffic to the CDE is restricted in accordance with all elements specified in this requirement.

• To only traffic that is necessary.

• All other traffic is specifically denied.

PCI DSS Requirement 1.3.2 Outbound traffic from the CDE is restricted as follows:

Removed p. 66

<Enter Response Here> 1.3.2.b Examine configurations of NSCs to verify that outbound traffic from the CDE is restricted in accordance with all elements specified in this requirement.

PCI DSS Requirement 1.3.3 NSCs are installed between all wireless networks and the CDE, regardless of whether the wireless network is a CDE, such that:

• All wireless traffic from wireless networks into the CDE is denied by default.

• Only wireless traffic with an authorized business purpose is allowed into the CDE.

Removed p. 67

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.3.3 Examine configuration settings and network diagrams to verify that NSCs are implemented between all wireless networks and the CDE, in accordance with all elements specified in this requirement.

Removed p. 68

PCI DSS Requirement 1.4.1 NSCs are implemented between trusted and untrusted networks.

Removed p. 69

<Enter Response Here> 1.4.1.b Examine network configurations to verify that NSCs are in place between trusted and untrusted networks, in accordance with the documented configuration standards and network diagrams.

Identify the evidence reference number(s) from Section 6 for all network configurations examined for this testing procedure.

PCI DSS Requirement 1.4.2 Inbound traffic from untrusted networks to trusted networks is restricted to:

• Communications with system components that are authorized to provide publicly accessible services, protocols, and ports.

• Stateful responses to communications initiated by system components in a trusted network.

• All other traffic is denied.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.4.2 Examine vendor documentation and configurations of NSCs to verify that inbound traffic from untrusted networks to trusted networks is restricted in accordance with all elements specified in this requirement.

Removed p. 71

PCI DSS Requirement 1.4.3 Anti-spoofing measures are implemented to detect and block forged source IP addresses from entering the trusted network.

Removed p. 72

PCI DSS Requirement 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.4.4.a Examine the data-flow diagram and network diagram to verify that it is documented that system components storing cardholder data are not directly accessible from the untrusted networks.

Identify the evidence reference number(s) from Section 6 for all data-flow diagram examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all network diagram examined for this testing procedure.

<Enter Response Here> 1.4.4.b Examine configurations of NSCs to verify that controls are implemented such that system components storing cardholder data are not directly accessible from untrusted networks.

PCI DSS Requirement 1.4.5 The disclosure of internal IP addresses and routing information is limited to only authorized parties.

Removed p. 75

<Enter Response Here> 1.4.5.b Interview personnel and examine documentation to verify that controls are implemented such that any disclosure of internal IP addresses and routing information is limited to only authorized parties.

Removed p. 76

PCI DSS Requirement 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks (including the Internet) and the CDE as follows:

• Specific configuration settings are defined to prevent threats being introduced into the entity’s network.

• Security controls are actively running.

• Security controls are not alterable by users of the computing devices unless specifically documented and authorized by management on a case-by-case basis for a limited period.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.5.1.a Examine policies and configuration standards and interview personnel to verify security controls for computing devices that connect to both untrusted networks, and the CDE, are implemented in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all policies examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all configuration …

Modified p. 78 → 7

~~<Enter Response Here>~~ Validation Method

• Defined Approach ~~Indicate whether~~ a ~~Compensating Control was used: ☐ Yes ☐ No~~

Remove Validation Method

• Defined Approach reporting rows and add checkbox to note the use of a compensating control.

Removed p. 81

PCI DSS Requirement 2.2.1 Configuration standards are developed, implemented, and maintained to:

• Cover all system components.

• Address all known security vulnerabilities.

• Be consistent with industry-accepted system hardening standards or vendor hardening recommendations.

• Be updated as new vulnerability issues are identified, as defined in Requirement 6.3.1.

• Be applied when new systems are configured and verified as in place before or immediately after a system component is connected to a production environment.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 2.2.1.a Examine system configuration standards to verify they define processes that include all elements specified in this requirement.

Removed p. 82

<Enter Response Here> 2.2.1.b Examine policies and procedures and interview personnel to verify that system configuration standards are updated as new vulnerability issues are identified, as defined in Requirement 6.3.1.

Removed p. 82

<Enter Response Here> 2.2.1.c Examine configuration settings and interview personnel to verify that system configuration standards are applied when new systems are configured and verified as being in place before or immediately after a system component is connected to a production environment.

PCI DSS Requirement 2.2.2 Vendor default accounts are managed as follows:

• If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6.

• If the vendor default account(s) will not be used, the account is removed or disabled.

Identify the evidence reference number(s) from Section 6 for all configuration files examined for this testing procedure.

Removed p. 84

<Enter Response Here> 2.2.2.b Examine vendor documentation and observe a system administrator logging on using vendor default accounts to verify accounts are implemented in accordance with all elements specified in this requirement.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observations(s) conducted for this testing procedure.

<Enter Response Here> 2.2.2.c Examine configuration files and interview personnel to verify that all vendor default accounts that will not be used are removed or disabled.

PCI DSS Requirement 2.2.3 Primary functions requiring different security levels are managed as follows:

• Only one primary function exists on a system component, OR

• Primary functions with differing security levels that exist on the same system component are isolated from each other, OR

• Primary functions with differing security levels on the same system component are all secured to the level required by the function with the highest security need.

Removed p. 86

<Enter Response Here> 2.2.3.b Examine system configurations to verify that primary functions requiring different security levels are managed per one of the ways specified in this requirement.

Removed p. 86

<Enter Response Here> 2.2.3.c Where virtualization technologies are used, examine the system configurations to verify that system functions requiring different security levels are managed in one of the following ways:

• Functions with differing security needs do not co-exist on the same system component.

• Functions with differing security needs that exist on the same system component are isolated from each other.

• Functions with differing security needs on the same system component are all secured to the level required by the function with the highest security need.

PCI DSS Requirement 2.2.4 Only necessary services, protocols, daemons, and functions are enabled, and all unnecessary functionality is removed or disabled.

Removed p. 88

<Enter Response Here> 2.2.4.b Examine system configurations to verify the following:

• All unnecessary functionality is removed or disabled.

• Only required functionality, as documented in the configuration standards, is enabled.

PCI DSS Requirement 2.2.5 If any insecure services, protocols, or daemons are present:

• Business justification is documented.

• Additional security features are documented and implemented that reduce the risk of using insecure services, protocols, or daemons.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 2.2.5.a If any insecure services, protocols, or daemons are present, examine system configuration standards and interview personnel to verify they are managed and implemented in accordance with all elements specified in this requirement.

<Enter Response Here> 2.2.5.b If any insecure services, protocols, or daemons, are present, examine configuration settings to verify that additional security features are implemented to reduce the risk of using insecure services, daemons, and protocols.

PCI DSS Requirement 2.2.6 System security parameters are configured to prevent …

Removed p. 91

<Enter Response Here> 2.2.6.b Interview system administrators and/or security managers to verify they have knowledge of common security parameter settings for system components.

<Enter Response Here> 2.2.6.c Examine system configurations to verify that common security parameters are set appropriately and in accordance with the system configuration standards.

PCI DSS Requirement 2.2.7 All non-console administrative access is encrypted using strong cryptography.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 2.2.7.a Examine system configuration standards to verify they include encrypting all non-console administrative access using strong cryptography.

<Enter Response Here> 2.2.7.b Observe an administrator log on to system components and examine system configurations to verify that non-console administrative access is managed in accordance with this requirement.

Identify the evidence reference number(s) from Section 6 for all observation(s) of administrator log on(s) for this testing procedure.

Removed p. 93

Identify the evidence reference number(s) from Section 6 for all settings for system components and authentication services examined for this testing procedure.

<Enter Response Here> 2.2.7.d Examine vendor documentation and interview personnel to verify that strong cryptography for the technology in use is implemented according to industry best practices and/or vendor recommendations.

Removed p. 94

PCI DSS Requirement 2.3.1 For wireless environments connected to the CDE or transmitting account data, all wireless vendor defaults are changed at installation or are confirmed to be secure, including but not limited to:

• Default wireless encryption keys.

• Passwords on wireless access points.

• Any other security-related wireless vendor defaults.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 2.3.1.a Examine policies and procedures and interview responsible personnel to verify that processes are defined for wireless vendor defaults to either change them upon installation or to confirm them to be secure in accordance with all elements of this requirement.

<Enter Response Here> 2.3.1.b Examine vendor documentation and observe a system administrator logging into wireless devices to verify: o SNMP defaults are not used. o Default passwords/passphrases on wireless access points are not used.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for the observation(s) of administrator log in(s) for …

Removed p. 97

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all key-management documentation examined for this testing procedure.

Removed p. 98

Requirement 3: Protect Stored Account Data Requirement Description 3.1 Processes and mechanisms for protecting stored account data are defined and understood.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.1.2.a Examine documentation to verify that descriptions of roles and responsibilities performing activities in Requirement 3 are documented and assigned.

Removed p. 101

PCI DSS Requirement 3.2.1 Account data storage is kept to a minimum through implementation of data retention and disposal policies, procedures, and processes that include at least the following:

• Coverage for all locations of stored account data.

• Coverage for any sensitive authentication data (SAD) stored prior to completion of authorization. This bullet is a best practice until 31 March 2025, after which it will be required as part of Requirement 3.2.1 and must be fully considered during a PCI DSS assessment.

• Limiting data storage amount and retention time to that which is required for legal or regulatory, and/or business requirements.

• Specific retention requirements for stored account data that defines length of retention period and includes a documented business justification.

• Processes for secure deletion or rendering account data unrecoverable when no longer needed per the retention policy.

• A process for verifying, at least once every three months, that stored account data …

Removed p. 103

PCI DSS Requirement 3.3.1 SAD is not retained after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process.

Removed p. 104

<Enter Response Here> 3.3.1.b If SAD is received, examine the documented procedures and observe the secure data deletion processes to verify the data is rendered unrecoverable upon completion of the authorization process.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for the observation(s) of the secure data deletion processes for this testing procedure.

PCI DSS Requirement 3.3.1.1 The full contents of any track are not retained upon completion of the authorization process.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.3.1.1 Examine data sources to verify that the full contents of any track are not stored upon completion of the authorization process.

Removed p. 106

PCI DSS Requirement 3.3.1.2 The card verification code is not retained upon completion of the authorization process.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.3.1.2 Examine data sources, to verify that the card verification code is not stored upon completion of the authorization process.

PCI DSS Requirement 3.3.1.3 The personal identification number (PIN) and the PIN block are not retained upon completion of the authorization process.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.3.1.3 Examine data sources, to verify that PINs and PIN blocks are not stored upon completion of the authorization process.

PCI DSS Requirement 3.3.2 SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.

Removed p. 109

Identify the evidence reference number(s) from Section 6 for all data stores examined for this testing procedure.

Removed p. 109

PCI DSS Requirement 3.3.3 Additional requirement for issuers and companies that support issuing services and store sensitive authentication data: Any storage of sensitive authentication data is:

• Limited to that which is needed for a legitimate issuing business need and is secured.

• Encrypted using strong cryptography. This bullet is a best practice until 31 March 2025, after which it will be required as part of Requirement 3.3.3 and must be fully considered during a PCI DSS assessment.

Identify the evidence reference number(s) from Section 6 for all data stores examined for this testing procedure.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.3.3.a Additional testing procedure for issuers and companies that support issuing services and store sensitive authentication data: Examine documented policies and interview personnel to verify there is a documented business justification for the storage of sensitive authentication data.

Identify the evidence reference number(s) from Section 6 for all documented …

Removed p. 112

• PAN is masked when displayed such that only personnel with a legitimate business need can see more than the BIN and last four digits of the PAN.

• All roles not specifically authorized to see the full PAN must only see masked PANs.

<Enter Response Here> 3.4.1.b Examine system configurations to verify that full PAN is only displayed for roles with a documented business need, and that PAN is masked for all other requests.

<Enter Response Here> 3.4.1.c Examine displays of PAN (for example, on screen, on paper receipts) to verify that PANs are masked when displayed, and that only those with a legitimate business need are able to see more than the BIN and/or last four digits of the PAN.

Identify the evidence reference number(s) from Section 6 for all displays of PAN examined for this testing procedure.

PCI DSS Requirement 3.4.2 When using remote-access technologies, technical controls prevent copy and/or relocation of …

Removed p. 114

• Technical controls prevent all personnel not specifically authorized from copying and/or relocating PAN.

• A list of personnel with permission to copy and/or relocate PAN is maintained, together with the documented, explicit authorization and legitimate, defined business need.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all documented evidence for technical controls examined for this testing procedure.

<Enter Response Here> 3.4.2.b Examine configurations for remote-access technologies to verify that technical controls to prevent copy and/or relocation of PAN for all personnel, unless explicitly authorized.

<Enter Response Here> 3.4.2.c Observe processes and interview personnel to verify that only personnel with documented, explicit authorization and a legitimate, defined business need have permission to copy and/or relocate PAN when using remote-access technologies.

Identify the evidence reference number(s) from Section 6 for all observations(s) conducted for this testing procedure.

<Enter Response Here> Requirement Description 3.5 Primary account number (PAN) is secured wherever it is stored.

PCI …

Removed p. 116

<Enter Response Here> 3.5.1.b Examine data repositories and audit logs, including payment application logs, to verify the PAN is rendered unreadable using any of the methods specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all data repositories examined for this testing procedure.

Removed p. 116

<Enter Response Here> 3.5.1.c If hashed and truncated versions of the same PAN are present in the environment, examine implemented controls to verify that the hashed and truncated versions cannot be correlated to reconstruct the original PAN.

Identify the evidence reference number(s) from Section 6 for all implemented controls examined for this testing procedure.

PCI DSS Requirement 3.5.1.1 Hashes used to render PAN unreadable (per the first bullet of Requirement 3.5.1) are keyed cryptographic hashes of the entire PAN, with associated key-management processes and procedures in accordance with Requirements 3.6 and 3.7. Note: This requirement is considered a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

Identify the evidence reference number(s) from Section 6 for all data repositories examined for this testing procedure.

Removed p. 118

<Enter Response Here> 3.5.1.1.b Examine documentation about the key management procedures and processes associated with the keyed cryptographic hashes to verify keys are managed in accordance with Requirements 3.6 and 3.7.

<Enter Response Here> 3.5.1.1.c Examine data repositories to verify the PAN is rendered unreadable.

<Enter Response Here> 3.5.1.1.d Examine audit logs, including payment application logs, to verify the PAN is rendered unreadable.

Identify the evidence reference number(s) from Section 6 for all audit logs examined for this testing procedure.

PCI DSS Requirement 3.5.1.2 If disk-level or partition-level encryption (rather than file-, column-, or field-level database encryption) is used to render PAN unreadable, it is implemented only as follows:

• On removable electronic media OR

• If used for non-removable electronic media, PAN is also rendered unreadable via another mechanism that meets Requirement 3.5.1. Note: This requirement is considered a best practice until 31 March 2025, after which it will be required and must be fully …

Removed p. 119

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.5.1.2.a Examine encryption processes to verify that, if disk-level or partition-level encryption is used to render PAN unreadable, it is implemented only as follows:

• On removable electronic media, OR

• If used for non-removable electronic media, examine encryption processes used to verify that PAN is also rendered unreadable via another method that meets Requirement 3.5.1.

Identify the evidence reference number(s) from Section 6 for all encryption processes examined for this testing procedure.

Removed p. 120

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for the observation(s) of the encryption processes for this testing procedure.

PCI DSS Requirement 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable, it is managed as follows:

• Logical access is managed separately and independently of native operating system authentication and access control mechanisms.

• Decryption keys are not associated with user accounts.

• Authentication factors (passwords, passphrases, or cryptographic keys) that allow access to unencrypted data are stored securely.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.5.1.3.a If disk-level or partition-level encryption is used to render PAN unreadable, examine the system configuration and observe the authentication process to verify that logical access is implemented in accordance with all elements specified in this requirement.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observation(s) of …

Removed p. 123

PCI DSS Requirement 3.6.1.1 Additional requirement for service providers only: A documented description of the cryptographic architecture is maintained that includes:

• Details of all algorithms, protocols, and keys used for the protection of stored account data, including key strength and expiry date.

• Preventing the use of the same cryptographic keys in production and test environments. This bullet is a best practice until 31 March 2025, after which it will be required as part of Requirement 3.6.1 and must be fully considered during a PCI DSS assessment.

• Description of the key usage for each key.

• Inventory of any hardware security modules (HSMs), key management systems (KMS), and other secure cryptographic devices (SCDs) used for key management, including type and location of devices, as outlined in Requirement 12.3.4.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.6.1.1 Additional testing procedure for service provider assessments only: Interview responsible personnel and examine …

Removed p. 127

<Enter Response Here> 3.6.1.2.b Examine system configurations and key storage locations to verify that cryptographic keys used to encrypt/decrypt stored account data exist in one (or more) of the forms specified in this requirement.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all key storage locations examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all key storage locations examined for this testing procedure.

<Enter Response Here> 3.6.1.2.c Wherever key-encrypting keys are used, examine system configurations and key storage locations to verify:

PCI DSS Requirement 3.6.1.3 Access to cleartext cryptographic key components is restricted to the fewest number of custodians necessary.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.6.1.3 Examine user access lists to verify that access to cleartext cryptographic key components is restricted to the fewest number of custodians necessary.

Identify the evidence reference number(s) from Section 6 for …

Removed p. 130

Identify the evidence reference number(s) from Section 6 for all key storage locations examined for this testing procedure.

Removed p. 130

<Enter Response Here> Requirement Description 3.7 Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.

PCI DSS Requirement 3.7.1 Key-management policies and procedures are implemented to include generation of strong cryptographic keys used to protect stored account data.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.7.1.a Examine the documented key- management policies and procedures for keys used for protection of stored account data to verify that they define generation of strong cryptographic keys.

Identify the evidence reference number(s) from Section 6 for all documented key- management policies and procedures examined for this testing procedure.

<Enter Response Here> 3.7.1.b Observe the method for generating keys to verify that strong keys are generated.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the methods for generating keys for this testing procedure.

PCI DSS Requirement 3.7.2 …

Removed p. 133

Identify the evidence reference number(s) from Section 6 for the documented key management policies and procedures examined for this testing procedure.

<Enter Response Here> 3.7.2.b Observe the method for distributing keys to verify that keys are distributed securely.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the method for distributing keys for this testing procedure.

PCI DSS Requirement 3.7.3 Key-management policies and procedures are implemented to include secure storage of cryptographic keys used to protect stored account data.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.7.3.a Examine the documented key- management policies and procedures for keys used for protection of stored account data to verify that they define secure storage of cryptographic keys.

Removed p. 134

<Enter Response Here> 3.7.3.b Observe the method for storing keys to verify that keys are stored securely.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the method for storing keys for this testing procedure.

PCI DSS Requirement 3.7.4 Key management policies and procedures are implemented for cryptographic key changes for keys that have reached the end of their cryptoperiod, as defined by the associated application vendor or key owner, and based on industry best practices and guidelines, including the following:

• A defined cryptoperiod for each key type in use.

• A process for key changes at the end of the defined cryptoperiod.

Removed p. 136

<Enter Response Here> 3.7.4.b Interview personnel, examine documentation, and observe key storage locations to verify that keys are changed at the end of the defined cryptoperiod(s).

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observation(s) of key storage locations for this testing procedure.

PCI DSS Requirement 3.7.5 Key management policies procedures are implemented to include the retirement, replacement, or destruction of keys used to protect stored account data, as deemed necessary when:

• The key has reached the end of its defined cryptoperiod.

• The integrity of the key has been weakened, including when personnel with knowledge of a cleartext key component leaves the company, or the role for which the key component was known.

• The key is suspected of or known to be compromised.

• Retired or replaced keys are not used for encryption operations.

Removed p. 138

<Enter Response Here> 3.7.5.b Interview personnel to verify that processes are implemented in accordance with all elements specified in this requirement.

PCI DSS Requirement 3.7.6 Where manual cleartext cryptographic key-management operations are performed by personnel, key-management policies and procedures are implemented include managing these operations using split knowledge and dual control.

Identify the evidence reference number(s) from Section 6 for all documented key- management policies and procedures examined for this testing procedure.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.7.6.a Examine the documented key- management policies and procedures for keys used for protection of stored account data and verify that they define using split knowledge and dual control.

<Enter Response Here> 3.7.6.b Interview personnel and/or observe processes to verify that manual cleartext keys are managed with split knowledge and dual control.

PCI DSS Requirement 3.7.7 Key management policies and procedures are implemented to include the prevention of unauthorized substitution of cryptographic …

Removed p. 141

<Enter Response Here> 3.7.7.b Interview personnel and/or observe processes to verify that unauthorized substitution of keys is prevented.

PCI DSS Requirement 3.7.8 Key management policies and procedures are implemented to include that cryptographic key custodians formally acknowledge (in writing or electronically) that they understand and accept their key-custodian responsibilities.

Removed p. 143

<Enter Response Here> 3.7.8.b Examine documentation or other evidence showing that key custodians have provided acknowledgments in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all documentation or other evidence examined for this testing procedure.

PCI DSS Requirement 3.7.9 Additional requirement for service providers only: Where a service provider shares cryptographic keys with its customers for transmission or storage of account data, guidance on secure transmission, storage and updating of such keys is documented and distributed to the service provider’s customers.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 3.7.9 Additional testing procedure for service provider assessments only: If the service provider shares cryptographic keys with its customers for transmission or storage of account data, examine the documentation that the service provider provides to its customers to verify it includes guidance on how to securely transmit, store, and update customers’ keys …

Removed p. 148

PCI DSS Requirement 4.2.1 Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks:

• Only trusted keys and certificates are accepted.

• Certificates used to safeguard PAN during transmission over open, public networks are confirmed as valid and are not expired or revoked. This bullet is a best practice until 31 March 2025, after which it will be required as part of Requirement 4.2.1 and must be fully considered during a PCI DSS assessment.

• The protocol in use supports only secure versions or configurations and does not support fallback to, or use of insecure versions, algorithms, key sizes, or implementations.

• The encryption strength is appropriate for the encryption methodology in use.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 4.2.1.a Examine documented policies and procedures and interview personnel to verify processes are defined to include all elements specified in this requirement.

Identify …

Removed p. 151

4.2.1.1.b Examine the inventory of trusted keys and certificates to verify it is kept up to date.

Identify the evidence reference number(s) from Section 6 for all inventories of trusted keys examined for this testing procedure.

PCI DSS Requirement 4.2.1.2 Wireless networks transmitting PAN or connected to the CDE use industry best practices to implement strong cryptography for authentication and transmission.

Removed p. 152

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 4.2.1.2 Examine system configurations to verify that wireless networks transmitting PAN or connected to the CDE use industry best practices to implement strong cryptography for authentication and transmission.

PCI DSS Requirement 4.2.2 PAN is secured with strong cryptography whenever it is sent via end-user messaging technologies.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 4.2.2.a Examine documented policies and procedures to verify that processes are defined to secure PAN with strong cryptography whenever sent over end-user messaging technologies.

<Enter Response Here> 4.2.2.b Examine system configurations and vendor documentation to verify that PAN is secured with strong cryptography whenever it is sent via end-user messaging technologies.

Removed p. 154

Requirement 5: Protect All Systems and Networks from Malicious Software Requirement Description 5.1 Processes and mechanisms for protecting all systems and networks from malicious software are defined and understood.

Removed p. 158

PCI DSS Requirement 5.2.1 An anti-malware solution(s) is deployed on all system components, except for those system components identified in periodic evaluations per Requirement 5.2.3 that concludes the system components are not at risk from malware.

Removed p. 159

<Enter Response Here> 5.2.1.b For any system components without an anti-malware solution, examine the periodic evaluations to verify the component was evaluated and the evaluation concludes that the component is not at risk from malware.

Identify the evidence reference number(s) from Section 6 for all periodic evaluations examined for this testing procedure.

PCI DSS Requirement 5.2.2 The deployed anti-malware solution(s):

• Detects all known types of malware.

• Removes, blocks, or contains all known types of malware.

• Detects all known types of malware.

• Removes, blocks, or contains all known types of malware.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 5.2.2 Examine vendor documentation and configurations of the anti-malware solution(s) to verify that the solution:

PCI DSS Requirement 5.2.3 Any system components that are not at risk for malware are evaluated periodically to include the following:

• A documented list of all system components not at risk for malware.

• Identification and evaluation of evolving …

Removed p. 162

<Enter Response Here> 5.2.3.b Interview personnel to verify that the evaluations include all elements specified in this requirement.

<Enter Response Here> 5.2.3.c Examine the list of system components identified as not at risk of malware and compare to the system components without an anti-malware solution deployed per Requirement 5.2.1 to verify that the system components match for both requirements.

Identify the evidence reference number(s) from Section 6 for all lists of system components examined for this testing procedure.

PCI DSS Requirement 5.2.3.1 The frequency of periodic evaluations of system components identified as not at risk for malware is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

Removed p. 164

Identify the evidence reference number(s) from Section 6 for the targeted risk analysis examined for this testing procedure.

<Enter Response Here> 5.2.3.1.b Examine documented results of periodic evaluations of system components identified as not at risk for malware and interview personnel to verify that evaluations are performed at the frequency defined in the entity’s targeted risk analysis performed for this requirement.

Identify the evidence reference number(s) from Section 6 for all documented results of periodic evaluations of system components examined for this testing procedure.

Removed p. 165

PCI DSS Requirement 5.3.1 The anti-malware solution(s) is kept current via automatic updates.

Removed p. 166

<Enter Response Here> 5.3.1.b Examine system components and logs, to verify that the anti- malware solution(s) and definitions are current and have been promptly deployed Identify the evidence reference number(s) from Section 6 for all system components examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all logs examined for this testing procedure.

PCI DSS Requirement 5.3.2 The anti-malware solution(s):

• Performs periodic scans and active or real-time scans. OR

• Performs continuous behavioral analysis of systems or processes.

Removed p. 168

<Enter Response Here> 5.3.2.b Examine system components, including all operating system types identified as at risk for malware, to verify the solution(s) is enabled in accordance with at least one of the elements specified in this requirement.

<Enter Response Here> 5.3.2.c Examine logs and scan results to verify that the solution(s) is enabled in accordance with at least one of the elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all logs examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all scan results examined for this testing procedure.

PCI DSS Requirement 5.3.2.1 If periodic malware scans are performed to meet Requirement 5.3.2, the frequency of scans is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1. Note: This requirement is a best practice until 31 March 2025, after which it will …

Removed p. 170

<Enter Response Here> 5.3.2.1.b Examine documented results of periodic malware scans and interview personnel to verify scans are performed at the frequency defined in the entity’s targeted risk analysis performed for this requirement.

Identify the evidence reference number(s) from Section 6 for all documented results of periodic malware scans examined for this testing procedure.

PCI DSS Requirement 5.3.3 For removable electronic media, the anti-malware solution(s):

• Performs automatic scans of when the media is inserted, connected, or logically mounted, OR

• Performs continuous behavioral analysis of systems or processes when the media is inserted, connected, or logically mounted. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

<Enter Response Here> 5.3.3.c Examine logs and scan results to verify that the solution(s) is enabled in accordance with at least one of the elements specified in this requirement.

Identify the …

Removed p. 172

<Enter Response Here> 5.3.3.b Examine system components with removable electronic media connected to verify that the solution(s) is enabled in accordance with at least one of the elements as specified in this requirement.

PCI DSS Requirement 5.3.4 Audit logs for the anti-malware solution(s) are enabled and retained in accordance with Requirement 10.5.1.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 5.3.4 Examine anti-malware solution(s) configurations to verify logs Identify the evidence reference number(s) from Section 6 for all anti-malware <Enter Response Here>

Removed p. 174

PCI DSS Requirement 5.3.5 Anti-malware mechanisms cannot be disabled or altered by users, unless specifically documented, and authorized by management on a case-by-case basis for a limited time period.

Removed p. 175

Identify the evidence reference number(s) from Section 6 for all anti-malware solution configurations examined for this testing procedure.

<Enter Response Here> 5.3.5.b Interview responsible personnel and observe processes to verify that any requests to disable or alter anti-malware mechanisms are specifically documented and authorized by management on a case-by-case basis for a limited time period.

Removed p. 176

PCI DSS Requirement 5.4.1 Processes and automated mechanisms are in place to detect and protect personnel against phishing attacks. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

Removed p. 177

Identify the evidence reference number(s) from Section 6 for all observation(s) of implemented processes for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all mechanisms examined for this testing procedure.

Requirement 6: Develop and Maintain Secure Systems and Software Requirement Description 6.1 Processes and mechanisms for developing and maintaining secure systems and software are defined and understood.

Removed p. 180

<Enter Response Here> 6.1.2.b Interview personnel responsible for performing activities in Requirement 6 to verify that roles and responsibilities are assigned as documented and are understood.

<Enter Response Here> Requirement Description 6.2 Bespoke and custom software are developed securely.

PCI DSS Requirement 6.2.1 Bespoke and custom software are developed securely, as follows:

• Based on industry standards and/or best practices for secure development.

• In accordance with PCI DSS (for example, secure authentication and logging).

• Incorporating consideration of information security issues during each stage of the software development lifecycle.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 6.2.1 Examine documented software development procedures to verify that processes are defined that include all elements specified in this requirement.

Removed p. 182

PCI DSS Requirement 6.2.2 Software development personnel working on bespoke and custom software are trained at least once every 12 months as follows:

• On software security relevant to their job function and development languages.

• Including secure software design and secure coding techniques.

• Including, if security testing tools are used, how to use the tools for detecting vulnerabilities in software.

Removed p. 183

Identify the evidence reference number(s) from Section 6 for all software development procedures examined for this testing procedure.

<Enter Response Here> 6.2.2.b Examine training records and interview personnel to verify that software development personnel working on bespoke and custom software received software security training that is relevant to their job function and development languages in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all training records examined for this testing procedure.

PCI DSS Requirement 6.2.3 Bespoke and custom software is reviewed prior to being released into production or to customers, to identify and correct potential coding vulnerabilities, as follows:

• Code reviews ensure code is developed according to secure coding guidelines.

• Code reviews look for both existing and emerging software vulnerabilities.

• Appropriate corrections are implemented prior to release.

Removed p. 185

<Enter Response Here> 6.2.3.b Examine evidence of changes to bespoke and custom software to verify that the code changes were reviewed in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all evidence of changes examined for this testing procedure.

PCI DSS Requirement 6.2.3.1 If manual code reviews are performed for bespoke and custom software prior to release to production, code changes are:

• Reviewed by individuals other than the originating code author, and who are knowledgeable about code-review techniques and secure coding practices.

• Reviewed and approved by management prior to release.

Identify the evidence reference number(s) from Section 6 for all evidence of changes examined for this testing procedure.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 6.2.3.1.a If manual code reviews are performed for bespoke and custom software prior to release to production, examine documented software development procedures and interview responsible personnel …

Removed p. 190

PCI DSS Requirement 6.3.2 An inventory of bespoke and custom software, and third-party software components incorporated into bespoke and custom software is maintained to facilitate vulnerability and patch management. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 6.3.2.a Examine documentation and interview personnel to verify that an inventory of bespoke and custom software and third-party software components incorporated into bespoke and custom software is maintained, and that the inventory is used to identify and address vulnerabilities.

<Enter Response Here> 6.3.2.b Examine software documentation, including for bespoke and custom software that integrates third-party software components, and compare it to the inventory to verify that the inventory includes the bespoke and custom software and third-party software components.

Identify the evidence reference number(s) from Section 6 …

Removed p. 193

<Enter Response Here> 6.3.3.b Examine system components and related software and compare the list of installed security patches/updates to the most recent security patch/update information to verify vulnerabilities are addressed in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all system components and related software examined for this testing procedure.

Removed p. 194

PCI DSS Requirement 6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows:

• Reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods as follows:

• At least once every 12 months and after significant changes.

• By an entity that specializes in application security.

• Including, at a minimum, all common software attacks in Requirement 6.2.4.

• All vulnerabilities are ranked in accordance with requirement 6.3.1.

• All vulnerabilities are corrected.

• The application is re-evaluated after the corrections OR

• Installing an automated technical solution(s) that continually detects and prevents web-based attacks as follows:

• Installed in front of public-facing web applications to detect and prevent web-based attacks.

• Actively running and up to date as applicable.

• Generating audit logs.

• Configured to either block web-based attacks or generate an alert that is immediately investigated. Note: This requirement …

Removed p. 196

• If manual or automated vulnerability security assessment tools or methods are in use, examine documented processes, interview personnel, and examine records of application security assessments to verify that public- facing web applications are reviewed in accordance with all elements of this requirement specific to the tool/method. OR

• If an automated technical solution(s) is installed that continually detects and prevents web-based attacks, examine the system configuration settings and audit logs, and interview responsible personnel to verify that the automated technical solution(s) is installed in accordance with all elements of this requirement specific to the solution(s).

Identify the evidence reference number(s) from Section 6 for all documented processes examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all records of application security assessments examined for this testing procedure.

Removed p. 197

• Actively running and up to date as applicable.

• Generating audit logs.

PCI DSS Requirement 6.4.2 For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following:

• Is installed in front of public-facing web applications and is configured to detect and prevent web-based attacks.

• Configured to either block web-based attacks or generate an alert that is immediately investigated. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment. This new requirement will replace Requirement 6.4.1 once its effective date is reached.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 6.4.2 For public-facing web applications, examine the system configuration settings and audit logs, and interview responsible personnel to verify that an automated technical solution that detects and prevents web-based attacks is in …

Removed p. 199

PCI DSS Requirement 6.4.3 All payment page scripts that are loaded and executed in the consumer's browser are managed as follows:

• A method is implemented to confirm that each script is authorized.

• A method is implemented to assure the integrity of each script.

• An inventory of all scripts is maintained with written justification as to why each is necessary. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

Removed p. 200

<Enter Response Here> 6.4.3.b Interview responsible personnel and examine inventory records and system configurations to verify that all payment page scripts that are loaded and executed in the consumer’s browser are managed in accordance with all elements specified in this requirement.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all inventory records examined for this testing procedure.

Removed p. 201

PCI DSS Requirement 6.5.1 Changes to all system components in the production environment are made according to established procedures that include:

• Reason for, and description of, the change.

• Documentation of security impact.

• Documented change approval by authorized parties.

• Testing to verify that the change does not adversely impact system security.

• For bespoke and custom software changes, all updates are tested for compliance with Requirement 6.2.4 before being deployed into production.

• Procedures to address failures and return to a secure state.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 6.5.1.a Examine documented change control procedures to verify procedures are defined for changes to all system components in the production environment to include all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all documented change control procedures examined for this testing procedure.

<Enter Response Here> 6.5.1.b Examine recent changes to system components and trace those changes …

Removed p. 204

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observation(s) of the affected systems/networks for this testing procedure.

PCI DSS Requirement 6.5.3 Pre-production environments are separated from production environments and the separation is enforced with access controls.

Removed p. 206

<Enter Response Here> 6.5.3.b Examine network documentation and configurations of network security controls to verify that the pre-production environment is separate from the production environment(s).

Identify the evidence reference number(s) from Section 6 for all network documentation examined for this testing procedure.

<Enter Response Here> 6.5.3.c Examine access control settings to verify that access controls are in place to enforce separation between the pre-production and production environment(s).

Identify the evidence reference number(s) from Section 6 for all access control settings examined for this testing procedure.

PCI DSS Requirement 6.5.4 Roles and functions are separated between production and pre-production environments to provide accountability such that only reviewed and approved changes are deployed.

Removed p. 208

<Enter Response Here> 6.5.4.b Observe processes and interview personnel to verify implemented controls separate roles and functions and provide accountability such that only reviewed and approved changes are deployed.

Removed p. 208

PCI DSS Requirement 6.5.5 Live PANs are not used in pre-production environments, except where those environments are included in the CDE and protected in accordance with all applicable PCI DSS requirements.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 6.5.5.a Examine policies and procedures to verify that processes are defined for not using live PANs in pre-production environments, except where those environments are in a CDE and protected in accordance with all applicable PCI DSS requirements.

<Enter Response Here> 6.5.5.b Observe testing processes and interview personnel to verify procedures are in place to ensure live PANs are not used in pre-production environments, except where those environments are in a CDE and protected in accordance with all applicable PCI DSS requirements.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the testing processes for this testing procedure.

Removed p. 210

Identify the evidence reference number(s) from Section 6 for all pre-production test data examined for this testing procedure.

PCI DSS Requirement 6.5.6 Test data and test accounts are removed from system components before the system goes into production.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the testing processes for this testing procedure.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 6.5.6.a Examine policies and procedures to verify that processes are defined for removal of test data and test accounts from system components before the system goes into production.

<Enter Response Here> 6.5.6.b Observe testing processes for both off-the-shelf software and in- house applications, and interview personnel to verify test data and test accounts are removed before a system goes into production.

<Enter Response Here> 6.5.6.c Examine data and accounts for recently installed or updated off- the-shelf software and in-house applications to verify there is no test data …

Removed p. 212

Requirement 7: Restrict Access to System Components and Cardholder Data by Business Need to Know Requirement Description 7.1 Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understood.

Removed p. 215

<Enter Response Here> 7.1.2.b Interview personnel with responsibility for performing activities in Requirement 7 to verify that roles and responsibilities are assigned as and are understood.

Removed p. 216

PCI DSS Requirement 7.2.1 An access control model is defined and includes granting access as follows:

• Appropriate access depending on the entity's business and access needs.

• Access to system components and data resources that is based on users' job classification and functions.

• The least privileges required (for example, user, administrator) to perform a job function.

<Enter Response Here> Validation Method

• Defined Approach Indicate whether a Compensating Control was used: ☐ Yes ☐ No If “Yes”, Identify the aspect(s) of the requirement where the Compensating Control(s) was used.

Note: The use of Compensating Controls must also be documented in Appendix C.

Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 7.2.1.a Examine documented policies and procedures and interview personnel to verify the access control model is defined in accordance with all elements specified in this requirement.

<Enter Response Here> 7.2.1.b Examine access control model settings and verify that access needs are appropriately defined in accordance with …

Removed p. 220

<Enter Response Here> 7.2.3.b Examine user IDs and assigned privileges, and compare with documented approvals to verify that:

• Documented approval exists for the assigned privileges.

• The approval was by authorized personnel.

• Specified privileges match the roles assigned to the individual.

Identify the evidence reference number(s) from Section 6 for all user IDs and assigned privileges examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all documented approvals examined for this testing procedure.

PCI DSS Requirement 7.2.4 All user accounts and related access privileges, including third-party/vendor accounts, are reviewed as follows:

• At least once every six months.

• To ensure user accounts and access remain appropriate based on job function.

• Any inappropriate access is addressed.

• Management acknowledges that access remains appropriate. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS …

Removed p. 222

<Enter Response Here> 7.2.4.b Interview responsible personnel and examine documented results of periodic reviews of user accounts to verify that all the results are in accordance with all elements specified in this requirement.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for the documented results of periodic reviews of user accounts examined for this testing procedure.

PCI DSS Requirement 7.2.5 All application and system accounts and related access privileges are assigned and managed as follows:

• Based on the least privileges necessary for the operability of the system or application.

• Access is limited to the systems, applications, or processes that specifically require their use. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 7.2.5.a Examine policies and procedures to verify they define …

Removed p. 225

<Enter Response Here> 7.2.5.1.c Interview responsible personnel and examine documented results of periodic reviews of system and application accounts and related privileges to verify that the reviews occur in accordance with all elements specified in this requirement.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all documented results of periodic reviews examined for this testing procedure.

PCI DSS Requirement 7.2.6 All user access to query repositories of stored cardholder data is restricted as follows:

• Via applications or other programmatic methods, with access and allowed actions based on user roles and least privileges.

• Only the responsible administrator(s) can directly access or query repositories of stored CHD.

Removed p. 227

<Enter Response Here> 7.2.6.b Examine configuration settings for querying repositories of stored cardholder data to verify they are in accordance with all elements specified in this requirement.

Removed p. 228

PCI DSS Requirement 7.3.1 An access control system(s) is in place that restricts access based on a user’s need to know and covers all system components.

Removed p. 229

PCI DSS Requirement 7.3.2 The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 7.3.2 Examine vendor documentation and system settings to verify that the access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function.

PCI DSS Requirement 7.3.3 The access control system(s) is set to “deny all” by default.

Removed p. 232

Requirement 8: Identify Users and Authenticate Access to System Components Requirement Description 8.1 Processes and mechanisms for identifying users and authenticating access to system components are defined and understood.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.1.1 Examine documentation and interview personnel to verify that security policies and operational procedures that are identified in Requirement 8 are managed in accordance with all elements specified in this requirement.

<Enter Response Here> 8.1.2.b Interview personnel with responsibility for performing activities in Requirement 8 to verify that roles Identify the evidence reference number(s) from Section 6 for all interview(s) conducted for this testing procedure.

Removed p. 235

Requirement Description 8.2 User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycle.

PCI DSS Requirement 8.2.1 All users are assigned a unique ID before access to system components or cardholder data is allowed.

Identify the evidence reference number(s) from Section 6 for all audit logs examined for this testing procedure.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.2.1.a Interview responsible personnel to verify that all users are assigned a unique ID for access to system components and cardholder data.

<Enter Response Here> 8.2.1.b Examine audit logs and other evidence to verify that access to system components and cardholder data can be uniquely identified and associated with individuals.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for any other evidence examined for this testing procedure.

PCI DSS Requirement 8.2.2 Group, shared, or generic accounts, or other shared authentication credentials are only used when …

Removed p. 238

<Enter Response Here> 8.2.2.c Interview system administrators to verify that shared authentication credentials are only used when necessary, on an exception basis, and are managed in accordance with all elements specified in this requirement.

PCI DSS Requirement 8.2.3 Additional requirement for service providers only: Service providers with remote access to customer premises use unique authentication factors for each customer premises.

Removed p. 240

PCI DSS Requirement 8.2.4 Addition, deletion, and modification of user IDs, authentication factors, and other identifier objects are managed as follows:

• Authorized with the appropriate approval.

• Implemented with only the privileges specified on the documented approval.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.2.4 Examine documented authorizations across various phases of the account lifecycle (additions, modifications, and deletions) and examine system settings to verify the activity has been managed in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all documented authorizations examined for this testing procedure.

PCI DSS Requirement 8.2.5 Access for terminated users is immediately revoked.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.2.5.a Examine information sources for terminated users and review Identify the evidence reference number(s) from Section 6 for all information <Enter Response Here>

Removed p. 243

Identify the evidence reference number(s) from Section 6 for all current user access lists examined for this testing procedure.

<Enter Response Here> 8.2.5.b Interview responsible personnel to verify that all physical authentication factors

•such as, smart cards, tokens, etc.

•have been returned or deactivated for terminated users.

PCI DSS Requirement 8.2.6 Inactive user accounts are removed or disabled within 90 days of inactivity.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.2.6 Examine user accounts and last logon information, and interview personnel to verify that any inactive user accounts are removed or disabled within 90 days of inactivity.

Identify the evidence reference number(s) from Section 6 for all user accounts and last login information examined for this testing procedure.

PCI DSS Requirement 8.2.7 Accounts used by third parties to access, support, or maintain system components via remote access are managed as follows:

• Enabled only during the time period needed and disabled when not in …

Removed p. 246

PCI DSS Requirement 8.2.8 If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.2.8 Examine system configuration settings to verify that system/session idle timeout features for user sessions have been set to 15 minutes or less.

Removed p. 248

PCI DSS Requirement 8.3.1 All user access to system components for users and administrators is authenticated via at least one of the following authentication factors:

• Something you know, such as a password or passphrase.

• Something you have, such as a token device or smart card.

• Something you are, such as a biometric element.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.3.1.a Examine documentation describing the authentication factor(s) used to verify that user access to system components is authenticated via at least one authentication factor specified in this requirement.

<Enter Response Here> 8.3.1.b For each type of authentication factor used with each type of system component, observe an authentication to verify that authentication is functioning consistently with documented authentication factor(s).

Identify the evidence reference number(s) from Section 6 for all observation(s) of each type of authentication factor used for this testing procedure.

PCI DSS Requirement 8.3.2 Strong cryptography is used to …

Removed p. 251

<Enter Response Here> 8.3.2.b Examine repositories of authentication factors to verify that they are unreadable during storage.

Identify the evidence reference number(s) from Section 6 for all repositories of authentication factors examined for this testing procedure.

<Enter Response Here> 8.3.2.c Examine data transmissions to verify that authentication factors are unreadable during transmission.

Identify the evidence reference number(s) from Section 6 for all data transmissions examined for this testing procedure.

PCI DSS Requirement 8.3.3 User identity is verified before modifying any authentication factor.

Removed p. 253

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observation(s) of security personnel for this testing procedure.

PCI DSS Requirement 8.3.4 Invalid authentication attempts are limited by:

• Locking out the user ID after not more than 10 attempts.

• Setting the lockout duration to a minimum of 30 minutes or until the user’s identity is confirmed.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.3.4.a Examine system configuration settings to verify that authentication parameters are set to require that user accounts be locked out after not more than 10 invalid logon attempts.

<Enter Response Here> 8.3.4.b Examine system configuration settings to verify that password parameters are set to require that once a user account is locked out, it remains locked for a minimum of 30 minutes or until the user’s identity is confirmed.

PCI DSS Requirement 8.3.5 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, …

Removed p. 257

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.3.6 Examine system configuration settings to verify that user password/passphrase complexity parameters are set in accordance with all elements specified in this requirement.

PCI DSS Requirement 8.3.7 Individuals are not allowed to submit a new password/passphrase that is the same as any of the last four passwords/passphrases used.

Removed p. 259

PCI DSS Requirement 8.3.8 Authentication policies and procedures are documented and communicated to all users including:

• Guidance on selecting strong authentication factors.

• Guidance for how users should protect their authentication factors.

• Instructions not to reuse previously used passwords/passphrases.

• Instructions to change passwords/passphrases if there is any suspicion or knowledge that the password/passphrases have been compromised and how to report the incident.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.3.8.a Examine procedures and interview personnel to verify that authentication policies and procedures are distributed to all users.

<Enter Response Here> 8.3.8.b Review authentication policies and procedures that are distributed to users and verify they include the elements specified in this requirement.

<Enter Response Here> 8.3.8.c Interview users to verify that they are familiar with authentication policies and procedures.

PCI DSS Requirement 8.3.9 If passwords/passphrases are used as the only authentication factor for user access (i.e., in any single-factor authentication implementation) then …

Removed p. 262

PCI DSS Requirement 8.3.10 Additional requirement for service providers only: If passwords/passphrases are used as the only authentication factor for customer user access to cardholder data (i.e., in any single-factor authentication implementation), then guidance is provided to customer users including:

• Guidance for customers to change their user passwords/passphrases periodically.

• Guidance as to when, and under what circumstances, passwords/passphrases are to be changed. Note: This requirement for service providers will be superseded by Requirement 8.3.10.1 as of 31 March 2025.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.3.10 Additional testing procedure for service provider assessments only: If passwords/passphrases are used as the only authentication factor for customer user access to cardholder data, examine guidance provided to customer users to verify that the guidance includes all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all guidance provided to customer users examined for this testing …

Removed p. 267

<Enter Response Here> 8.3.11.b Interview security personnel to verify authentication factors are assigned to an individual user and not shared among multiple users.

<Enter Response Here> 8.3.11.c Examine system configuration settings and/or observe physical controls, as applicable, to verify that controls are implemented to ensure only the intended user can use that factor to gain access.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observations of physical controls conducted for this testing procedure.

Removed p. 268

PCI DSS Requirement 8.4.1 MFA is implemented for all non-console access into the CDE for personnel with administrative access.

Removed p. 269

<Enter Response Here> 8.4.1.b Observe administrator personnel logging into the CDE and verify that MFA is required.

Identify the evidence reference number(s) from Section 6 for all observation(s) of administrator personnel logging into the CDE for this testing procedure.

PCI DSS Requirement 8.4.2 MFA is implemented for all access into the CDE. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.4.2.a Examine network and/or system configurations to verify MFA is implemented for all access into the CDE.

<Enter Response Here> 8.4.2.b Observe personnel logging in to the CDE and examine evidence to verify that MFA is required.

Identify the evidence reference number(s) from Section 6 for all observation(s) of personnel logging into the CDE for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) …

Removed p. 272

<Enter Response Here> 8.4.3.b Observe personnel (for example, users and administrators) connecting remotely to the network and verify that multi-factor authentication is required.

Identify the evidence reference number(s) from Section 6 for all observation(s) of personnel connecting remotely to the network for this testing procedure.

<Enter Response Here> Requirement Description 8.5 Multi-factor authentication (MFA) systems are configured to prevent misuse.

PCI DSS Requirement 8.5.1 MFA systems are implemented as follows:

• The MFA system is not susceptible to replay attacks.

• MFA systems cannot be bypassed by any users, including administrative users unless specifically documented, and authorized by management on an exception basis, for a limited time period.

• At least two different types of authentication factors are used.

• Success of all authentication factors is required before access is granted. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS …

Removed p. 274

Identify the evidence reference number(s) from Section 6 for all vendor system documentation examined for this testing procedure.

<Enter Response Here> 8.5.1.b Examine system configurations for the MFA implementation to verify it is configured in accordance with all elements specified in this requirement.

<Enter Response Here> 8.5.1.c Interview responsible personnel and observe processes to verify that any requests to bypass MFA are specifically documented and authorized by management on an exception basis, for a limited time period.

<Enter Response Here> 8.5.1.d Observe personnel logging into system components in the CDE to verify that access is granted only after all authentication factors are successful.

Identify the evidence reference number(s) from Section 6 for all observation(s) of personnel logging into system components in the CDE for this testing procedure.

<Enter Response Here> 8.5.1.e Observe personnel connecting remotely from outside the entity’s network to verify that access is granted only after all authentication factors are successful.

Identify the evidence …

Removed p. 275

PCI DSS Requirement 8.6.1 If accounts used by systems or applications can be used for interactive login, they are managed as follows:

• Interactive use is prevented unless needed for an exceptional circumstance.

• Interactive use is limited to the time needed for the exceptional circumstance.

• Business justification for interactive use is documented.

• Interactive use is explicitly approved by management.

• Individual user identity is confirmed before access to account is granted.

• Every action taken is attributable to an individual user. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 8.6.1 Examine application and system accounts that can be used interactively and interview administrative personnel to verify that application and system accounts are managed in accordance with all elements specified in this requirement.

Identify the evidence …

Removed p. 278

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all system development procedures examined for this testing procedure.

<Enter Response Here> 8.6.2.b Examine scripts, configuration/property files, and bespoke and custom source code for application and system accounts that can be used for interactive login, to verify passwords/passphrases for those accounts are not present.

Identify the evidence reference number(s) from Section 6 for all scripts, configuration/property files, and bespoke and custom source code examined for this testing procedure.

PCI DSS Requirement 8.6.3 Passwords/passphrases for any application and system accounts are protected against misuse as follows:

• Passwords/passphrases are changed periodically (at the frequency defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1) and upon suspicion or confirmation of compromise.

• Passwords/passphrases are constructed with sufficient complexity appropriate for how frequently the entity changes the passwords/passphrases. Note: This requirement is a best practice until 31 …

Removed p. 280

<Enter Response Here> 8.6.3.b Examine the entity’s targeted risk analysis for the change frequency and complexity for passwords/passphrases used for interactive login to application and system accounts to verify the risk analysis was performed in accordance with all elements specified in Requirement 12.3.1 and addresses:

• The frequency defined for periodic changes to application and system passwords/passphrases.

• The complexity defined for passwords/passphrases and appropriateness of the complexity relative to the frequency of changes.

<Enter Response Here> 8.6.3.c Interview responsible personnel and examine system configuration settings to verify that passwords/passphrases for any application and system accounts that can be used for interactive login are protected against misuse in accordance with all elements specified in this requirement.

Requirement 9: Restrict Physical Access to Cardholder Data Requirement Description 9.1 Processes and mechanisms for restricting physical access to cardholder data are defined and understood.

Removed p. 284

PCI DSS Requirement 9.2.1 Appropriate facility entry controls are in place to restrict physical access to systems in the CDE.

Removed p. 285

Identify the evidence reference number(s) from Section 6 for all observation(s) of the entry controls for this testing procedure.

PCI DSS Requirement 9.2.1.1 Individual physical access to sensitive areas within the CDE is monitored with either video cameras or physical access control mechanisms (or both) as follows:

• Entry and exit points to/from sensitive areas within the CDE are monitored.

• Monitoring devices or mechanisms are protected from tampering or disabling.

• Collected data is reviewed and correlated with other entries.

• Collected data is stored for at least three months, unless otherwise restricted by law.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.2.1.1.a Observe locations where individual physical access to sensitive areas within the CDE occurs to verify that either video cameras or physical access control mechanisms (or both) are in place to monitor the entry and exit points.

Identify the evidence reference number(s) from Section 6 for all observation(s) of locations …

Removed p. 287

• Collected data from video cameras and/or physical access control mechanisms is reviewed and correlated with other entries.

• Collected data is stored for at least three months.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the physical access control mechanisms for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all video cameras examined for this testing procedure.

PCI DSS Requirement 9.2.2 Physical and/or logical controls are implemented to restrict use of publicly accessible network jacks within the facility.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.2.2 Interview responsible personnel and observe locations of publicly accessible network jacks to verify that physical and/or logical controls are in place to restrict access to publicly accessible network jacks within the facility.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observation(s) of the locations of publicly accessible network jacks …

Removed p. 290

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observation(s) of the locations of hardware and lines for this testing procedure.

PCI DSS Requirement 9.2.4 Access to consoles in sensitive areas is restricted via locking when not in use.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.2.4 Observe a system administrator’s attempt to log into consoles in sensitive areas and verify that they are “locked” to prevent unauthorized use.

Identify the evidence reference number(s) from Section 6 for all observation(s) of a system administrator’s attempt to log into consoles in sensitive areas for this testing procedure.

<Enter Response Here> Requirement Description 9.3 Physical access for personnel and visitors is authorized and managed.

PCI DSS Requirement 9.3.1 Procedures are implemented for authorizing and managing physical access of personnel to the CDE, including:

• Identifying personnel.

• Managing changes to an individual's physical access requirements.

• Revoking or terminating personnel identification.

• Limiting …

Removed p. 293

<Enter Response Here> 9.3.1.b Observe identification methods, such as ID badges, and processes to verify that personnel in the CDE are clearly identified.

Identify the evidence reference number(s) from Section 6 for all observation(s) of all identification methods and processes for this testing procedure.

<Enter Response Here> 9.3.1.c Observe processes to verify that access to the identification process, such as a badge system, is limited to authorized personnel.

PCI DSS Requirement 9.3.1.1 Physical access to sensitive areas within the CDE for personnel is controlled as follows:

• Access is authorized and based on individual job function.

• Access is revoked immediately upon termination.

• All physical access mechanisms, such as keys, access cards, etc., are returned or disabled upon termination.

Removed p. 295

• Access is required for the individual’s job function.

Identify the evidence reference number(s) from Section 6 for all observation(s) of personnel in sensitive areas for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all physical access control lists examined for this testing procedure.

<Enter Response Here> 9.3.1.1.b Observe processes and interview personnel to verify that access of all personnel is revoked immediately upon termination.

<Enter Response Here> 9.3.1.1.c For terminated personnel, examine physical access controls lists and interview responsible personnel to verify that all physical access mechanisms (such as keys, access cards, etc.) were returned or disabled.

Identify the evidence reference number(s) from Section 6 for all physical access control lists examined for this testing procedure.

PCI DSS Requirement 9.3.2 Procedures are implemented for authorizing and managing visitor access to the CDE, including:

• Visitors are authorized before entering.

• Visitors are escorted at all times.

• Visitors are clearly identified …

Removed p. 297

<Enter Response Here> 9.3.2.b Observe processes when visitors are present in the CDE and interview personnel to verify that visitors are:

• Authorized before entering the CDE.

• Escorted at all times within the CDE.

Identify the evidence reference number(s) from Section 6 for all observation(s) of processes when visitors are present in the CDE for this testing procedure.

<Enter Response Here> 9.3.2.c Observe the use of visitor badges or other identification to verify that the badge or other identification does not permit unescorted access to the CDE.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the use of visitor badges or other identification for this testing procedure.

<Enter Response Here> 9.3.2.d Observe visitors in the CDE to verify that:

• Visitor badges or other identification are being used for all visitors.

• Visitor badges or identification easily distinguish visitors from personnel.

Removed p. 298

Identify the evidence reference number(s) from Section 6 for all visitor badges or other identification examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observation(s) of evidence in the badging system for this testing procedure.

PCI DSS Requirement 9.3.3 Visitor badges or identification are surrendered or deactivated before visitors leave the facility or at the date of expiration.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.3.3 Observe visitors leaving the facility and interview personnel to verify visitor badges or other identification are surrendered or deactivated before visitors leave the facility or at the date of expiration. upon departure or expiration.

Identify the evidence reference number(s) from Section 6 for all observation(s) of visitors leaving the facility for this testing procedure.

PCI DSS Requirement 9.3.4 A visitor log is used to maintain a physical record of visitor activity within the facility and within …

Removed p. 301

Identify the evidence reference number(s) from Section 6 for all visitor logs examined for this testing procedure.

Identify the evidence reference number(s) from Section 6 for all visitor logs examined for this testing procedure.

<Enter Response Here> 9.3.4.b Examine the visitor log and verify that the log contains:

• The visitor’s name and the organization represented.

• The personnel authorizing physical access.

• Date and time of visit.

<Enter Response Here> 9.3.4.c Examine visitor log storage locations and interview responsible personnel to verify that the log is retained for at least three months, unless otherwise restricted by law.

Identify the evidence reference number(s) from Section 6 for all visitor log storage locations examined for this testing procedure.

Removed p. 302

PCI DSS Requirement 9.4.1 All media with cardholder data is physically secured.

Removed p. 303

PCI DSS Requirement 9.4.1.1 Offline media backups with cardholder data are stored in a secure location.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.4.1.1.a Examine documentation to verify that procedures are defined for physically securing offline media backups with cardholder data in a secure location.

<Enter Response Here> 9.4.1.1.b Examine logs or other documentation and interview responsible personnel at the storage location to verify that offline media backups are stored in a secure location.

Identify the evidence reference number(s) from Section 6 for all logs or other documentation examined for this testing procedure.

PCI DSS Requirement 9.4.1.2 The security of the offline media backup location(s) with cardholder data is reviewed at least once every 12 months.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.4.1.2.a Examine documentation to verify that procedures are defined for reviewing the security of the offline Identify the evidence reference number(s) from Section 6 …

Removed p. 306

9.4.1.2.b Examine documented procedures, logs, or other documentation, and interview responsible personnel at the storage location(s) to verify that the storage location’s security is reviewed at least once every 12 months.

Identify the evidence reference number(s) from Section 6 for all documented procedures, logs, or other documentation examined for this testing procedure.

PCI DSS Requirement 9.4.2 All media with cardholder data is classified in accordance with the sensitivity of the data.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.4.2.a Examine documentation to verify that procedures are defined for classifying media with cardholder data in accordance with the sensitivity of the data.

<Enter Response Here> 9.4.2.b Examine media logs or other documentation to verify that all media is classified in accordance with the sensitivity of the data.

Identify the evidence reference number(s) from Section 6 for all media logs or other documentation examined for this testing procedure.

PCI DSS Requirement 9.4.3 Media with …

Removed p. 309

<Enter Response Here> 9.4.3.b Interview personnel and examine records to verify that all media sent outside the facility is logged and sent via secured courier or other delivery method that can be tracked.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all records examined for this testing procedure.

<Enter Response Here> 9.4.3.c Examine offsite tracking logs for all media to verify tracking details are documented.

Identify the evidence reference number(s) from Section 6 for all offsite tracking logs examined for this testing procedure.

PCI DSS Requirement 9.4.4 Management approves all media with cardholder data that is moved outside the facility (including when media is distributed to individuals).

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.4.4.a Examine documentation to verify that procedures are defined to ensure that media moved outside the facility is approved by management.

<Enter Response Here> 9.4.4.b Examine offsite media tracking logs and interview responsible personnel …

Removed p. 312

<Enter Response Here> 9.4.5.b Examine electronic media inventory logs and interview responsible personnel to verify that logs are maintained.

Identify the evidence reference number(s) from Section 6 for all electronic media inventory logs examined for this testing procedure.

PCI DSS Requirement 9.4.5.1 Inventories of electronic media with cardholder data are conducted at least once every 12 months.

Identify the evidence reference number(s) from Section 6 for all electronic media inventory logs examined for this testing procedure.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.4.5.1.a Examine documentation to verify that procedures are defined to conduct inventories of electronic media with cardholder data at least once every 12 months.

<Enter Response Here> 9.4.5.1.b Examine electronic media inventory logs and interview personnel to verify that electronic media inventories are performed at least once every 12 months.

PCI DSS Requirement 9.4.6 Hard-copy materials with cardholder data are destroyed when no longer needed for business or legal …

Removed p. 315

Identify the evidence reference number(s) from Section 6 for the periodic media destruction policy examined for this testing procedure.

<Enter Response Here> 9.4.6.b Observe processes and interview personnel to verify that hard- copy materials are cross-cut shredded, incinerated, or pulped such that cardholder data cannot be reconstructed.

<Enter Response Here> 9.4.6.c Observe storage containers used for materials that contain information to be destroyed to verify that the containers are secure.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the storage containers used for materials that contain information to be destroyed for this testing procedure.

PCI DSS Requirement 9.4.7 Electronic media with cardholder data is destroyed when no longer needed for business or legal reasons via one of the following:

• The electronic media is destroyed.

• The cardholder data is rendered unrecoverable so that it cannot be reconstructed.

Identify the evidence reference number(s) from Section 6 for the periodic media destruction policy examined …

Removed p. 317

<Enter Response Here> 9.4.7.b Observe the media destruction process and interview responsible personnel to verify that electronic media with cardholder data is destroyed via one of the methods specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the media destruction process for this testing procedure.

<Enter Response Here> Requirement Description 9.5 Point-of-interaction (POI) devices are protected from tampering and unauthorized substitution.

PCI DSS Requirement 9.5.1 POI devices that capture payment card data via direct physical interaction with the payment card form factor are protected from tampering and unauthorized substitution, including the following:

• Maintaining a list of POI devices.

• Periodically inspecting POI devices to look for tampering or unauthorized substitution.

• Training personnel to be aware of suspicious behavior and to report tampering or unauthorized substitution of devices.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.5.1 Examine documented policies and procedures to verify that processes …

Removed p. 320

Identify the evidence reference number(s) from Section 6 for all lists of POI devices examined for this testing procedure.

<Enter Response Here> 9.5.1.1.b Observe POI devices and device locations and compare to devices in the list to verify that the list is accurate and up to date.

Identify the evidence reference number(s) from Section 6 for all observation(s) of the POI devices and device locations for this testing procedure.

<Enter Response Here> 9.5.1.1.c Interview personnel to verify the list of POI devices is updated when devices are added, relocated, decommissioned, etc.

PCI DSS Requirement 9.5.1.2 POI device surfaces are periodically inspected to detect tampering and unauthorized substitution.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 9.5.1.2.a Examine documented procedures to verify processes are defined for periodic inspections of POI device surfaces to detect tampering and unauthorized substitution.

<Enter Response Here> 9.5.1.2.b Interview responsible personnel and observe inspection processes to verify:

• Personnel are aware …

Removed p. 323

<Enter Response Here> 9.5.1.2.1.b Examine documented results of periodic device inspections and interview personnel to verify that the frequency and type of POI device inspections performed match what is defined in the entity’s targeted risk analysis conducted for this requirement.

Identify the evidence reference number(s) from Section 6 for the documented results of periodic device inspections examined for this testing procedure.

PCI DSS Requirement 9.5.1.3 Training is provided for personnel in POI environments to be aware of attempted tampering or replacement of POI devices, and includes:

• Verifying the identity of any third-party persons claiming to be repair or maintenance personnel, before granting them access to modify or troubleshoot devices.

• Procedures to ensure devices are not installed, replaced, or returned without verification.

• Being aware of suspicious behavior around devices.

• Reporting suspicious behavior and indications of device tampering or substitution to appropriate personnel.

Removed p. 325

Identify the evidence reference number(s) from Section 6 for all training materials examined for this testing procedure.

<Enter Response Here> 9.5.1.3.b Interview personnel in POI environments to verify they have received training and know the procedures for all elements specified in this requirement.

Removed p. 326

Requirement 10: Log and Monitor All Access to System Components and Cardholder Data Requirement Description 10.1 Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documented.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.1.2.a Examine documentation to verify that descriptions of roles and responsibilities for performing Identify the evidence reference number(s) from Section 6 for all documentation examined for this testing procedure.

Removed p. 329

10.1.2.b Interview personnel with responsibility for performing activities in Requirement 10 to verify that roles and responsibilities are assigned as defined and are understood.

Removed p. 330

PCI DSS Requirement 10.2.1 Interview the system administrator and examine system configurations to verify that audit logs are enabled and active for all system components.

Removed p. 331

PCI DSS Requirement 10.2.1.1 Audit logs capture all individual user access to cardholder data.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.2.1.1 Examine audit log configurations and log data to verify that all individual user access to cardholder data is logged.

Removed p. 333

PCI DSS Requirement 10.2.1.2 Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.2.1.2 Examine audit log configurations and log data to verify Identify the evidence reference number(s) from Section 6 for all audit log <Enter Response Here>

Removed p. 334

Identify the evidence reference number(s) from Section 6 for all log data examined for this testing procedure.

PCI DSS Requirement 10.2.1.3 Audit logs capture all access to audit logs.

Removed p. 335

PCI DSS Requirement 10.2.1.4 Audit logs capture all invalid logical access attempts.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.2.1.4 Examine audit log configurations and log data to verify that invalid logical access attempts are captured.

PCI DSS Requirement 10.2.1.5 Audit logs capture all changes to identification and authentication credentials including, but not limited to:

• Creation of new accounts.

• Elevation of privileges.

• All changes, additions, or deletions to accounts with administrative access.

Removed p. 338

PCI DSS Requirement 10.2.1.6 Audit logs capture the following:

• All initialization of new audit logs, and

• All starting, stopping, or pausing of the existing audit logs.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.2.1.6 Examine audit log configurations and log data to verify that all elements specified in this requirement are captured.

PCI DSS Requirement 10.2.1.7 Audit logs capture all creation and deletion of system-level objects.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.2.1.7 Examine audit log configurations and log data to verify that creation and deletion of system level objects is captured.

PCI DSS Requirement 10.2.2 Audit logs record the following details for each auditable event:

• User identification.

• Success and failure indication.

• Origination of event.

• Identity or name of affected data, system component, resource, or service (for example, name and protocol).

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.2.2 Interview personnel and …

Removed p. 343

PCI DSS Requirement 10.3.1 Read access to audit logs files is limited to those with a job-related need.

Removed p. 344

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all system configurations and privileges examined for this testing procedure.

PCI DSS Requirement 10.3.2 Audit log files are protected to prevent modifications by individuals.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.3.2 Examine system configurations and privileges and interview system administrators to verify that current audit log files are protected from modifications by individuals via access control mechanisms, physical segregation, and/or network segregation.

Identify the evidence reference number(s) from Section 6 for all system configurations and privileges examined for this testing procedure.

PCI DSS Requirement 10.3.3 Audit log files, including those for external-facing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify.

Removed p. 347

Identify the evidence reference number(s) from Section 6 for all backup configurations or log files examined for this testing procedure.

PCI DSS Requirement 10.3.4 File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.3.4 Examine system settings, monitored files, and results from monitoring activities to verify the use of file integrity monitoring or change- detection software on audit logs.

Removed p. 348

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all monitored files examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all results from monitoring activities examined for this testing procedure.

Removed p. 349

PCI DSS Requirement 10.4.1 The following audit logs are reviewed at least once daily:

• All security events.

• Logs of all system components that store, process, or transmit CHD and/or SAD.

• Logs of all critical system components.

• Logs of all servers and system components that perform security functions (for example, network security controls, intrusion-detection systems/intrusion- prevention systems (IDS/IPS), authentication servers).

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.4.1.a Examine security policies and procedures to verify that processes are defined for reviewing all elements specified in this requirement at least once daily.

Removed p. 350

<Enter Response Here> 10.4.1.b Observe processes and interview personnel to verify that all elements specified in this requirement are reviewed at least once daily Identify the evidence reference number(s) from Section 6 for all observation(s) of processes for this testing procedure.

PCI DSS Requirement 10.4.1.1 Automated mechanisms are used to perform audit log reviews. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

Removed p. 352

Identify the evidence reference number(s) from Section 6 for all log review mechanisms examined for this testing procedure.

PCI DSS Requirement 10.4.2 Logs of all other system components (those not specified in Requirement 10.4.1) are reviewed periodically.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.4.2.a Examine security policies and procedures to verify that processes are defined for reviewing logs of all other system components periodically.

<Enter Response Here> 10.4.2.b Examine documented results of log reviews and interview personnel to verify that log reviews are performed periodically.

Identify the evidence reference number(s) from Section 6 for all documented results of log reviews examined for this testing procedure.

PCI DSS Requirement 10.4.2.1 The frequency of periodic log reviews for all other system components (not defined in Requirement 10.4.1) is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1 Note: This requirement is a best …

Removed p. 355

<Enter Response Here> 10.4.2.1.b Examine documented results of periodic log reviews of all other system components (not defined in Requirement 10.4.1) and interview personnel to verify log reviews are performed at the frequency specified in the entity’s targeted risk analysis performed for this requirement.

Identify the evidence reference number(s) from Section 6 for the documented results of all other system components (not defined in Requirement 10.4.1) examined for this testing procedure.

PCI DSS Requirement 10.4.3 Exceptions and anomalies identified during the review process are addressed.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.4.3.a Examine security policies and procedures to verify that processes are defined for addressing exceptions and anomalies identified during the review process.

<Enter Response Here> 10.4.3.b Observe processes and interview personnel to verify that, when exceptions and anomalies are identified, they are addressed.

Removed p. 357

PCI DSS Requirement 10.5.1 Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis.

Removed p. 358

• Audit log retention policies.

• Procedures for retaining audit log history for at least 12 months, with at least the most recent three months immediately available online.

<Enter Response Here> 10.5.1.b Examine configurations of audit log history, interview personnel and examine audit logs to verify that audit logs history is retained for at least 12 months.

<Enter Response Here> 10.5.1.c Interview personnel and observe processes to verify that at least the most recent three months’ audit log history is immediately available for analysis.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for the observation(s) of processes for this testing procedure.

Removed p. 359

PCI DSS Requirement 10.6.1 System clocks and time are synchronized using time-synchronization technology.

Removed p. 360

PCI DSS Requirement 10.6.2 Systems are configured to the correct and consistent time as follows:

• One or more designated time servers are in use.

• Only the designated central time server(s) receives time from external sources.

• Time received from external sources is based on International Atomic Time or Coordinated Universal Time (UTC).

• The designated time server(s) accept time updates only from specific industry-accepted external sources.

• Where there is more than one designated time server, the time servers peer with one another to keep accurate time.

• Internal systems receive time information only from designated central time server(s).

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.6.2 Examine system configuration settings for acquiring, distributing, and storing the correct time to verify the settings are configured in accordance with all elements specified in this requirement.

PCI DSS Requirement 10.6.3 Time synchronization settings and data are protected as follows:

• Access to time data is …

Removed p. 363

Identify the evidence reference number(s) from Section 6 for all system configurations and time- synchronization settings examined for this testing procedure.

<Enter Response Here> 10.6.3.b Examine system configurations and time synchronization settings and logs and observe processes to verify that any changes to time settings on critical systems are logged, monitored, and reviewed.

Identify the evidence reference number(s) from Section 6 for all system configurations time synchronization settings examined for this testing procedure.

Removed p. 364

PCI DSS Requirement 10.7.1 Additional requirement for service providers only: Failures of critical security control systems are detected, alerted, and addressed promptly, including but not limited to failure of the following critical security control systems:

Removed p. 364

• Anti-malware solutions.

• Physical access controls.

• Logical access controls.

• Audit logging mechanisms.

• Segmentation controls (if used). Note: This requirement will be superseded by Requirement 10.7.2 as of 31 March 2025.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.7.1.a Additional testing procedure for service provider assessments only: Examine documentation to verify that processes are defined for the prompt detection and addressing of failures of critical security control systems, including but not limited to failure of all elements specified in this requirement.

<Enter Response Here> 10.7.1.b Additional testing procedure for service provider assessments only: Observe detection and alerting processes and interview personnel to verify that failures of critical security control systems are detected and reported, and that failure of a critical security control results in the generation of an alert.

Identify the evidence reference number(s) from Section 6 for all observation(s) of detection and alerting processes conducted for this testing procedure.

• …

Removed p. 369

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 10.7.3.a Examine documentation and interview personnel to verify that processes are defined and implemented to respond to a failure of any critical security control system and include at least all elements specified in this requirement.

<Enter Response Here> 10.7.3.b Examine records to verify that failures of critical security control systems are documented to include:

• Identification of cause(s) of the failure.

• Duration (date and time start and end) of the security failure.

• Details of the remediation required to address the root cause.

Identify the evidence reference number(s) from Section 6 for all records examined for this testing procedure.

Requirement 11: Test Security of Systems and Networks Regularly Requirement Description 11.1 Processes and mechanisms for regularly testing security of systems and networks are defined and understood.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 11.1.1 Examine documentation and interview personnel to verify …

Removed p. 373

PCI DSS Requirement 11.2.1 Authorized and unauthorized wireless access points are managed as follows:

• The presence of wireless (Wi-Fi) access points is tested for,

• All authorized and unauthorized wireless access points are detected and identified,

• Testing, detection, and identification occurs at least once every three months.

• If automated monitoring is used, personnel are notified via generated alerts.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 11.2.1.a Examine policies and procedures to verify processes are defined for managing both authorized and unauthorized wireless access points with all elements specified in this requirement.

<Enter Response Here> 11.2.1.b Examine the methodology(ies) in use and the resulting documentation, and interview personnel to verify processes are defined to detect and identify both authorized and unauthorized wireless access points in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for the methodology(ies) in use and resulting documentation examined for …

Removed p. 376

<Enter Response Here> Requirement Description 11.3 External and internal vulnerabilities are regularly identified, prioritized, and addressed.

PCI DSS Requirement 11.3.1 Internal vulnerability scans are performed as follows:

• At least once every three months.

• High-risk and critical vulnerabilities (per the entity's vulnerability risk rankings defined at Requirement 6.3.1) are resolved.

• Rescans are performed that confirm all high-risk and critical vulnerabilities (as noted above) have been resolved.

• Scan tool is kept up to date with latest vulnerability information.

• Scans are performed by qualified personnel and organizational independence of the tester exists.

Removed p. 378

Identify the evidence reference number(s) from Section 6 for all internal scan report results examined for this testing procedure.

Identify the evidence reference number(s) from Section 6 for all internal scan report results examined for this testing procedure.

<Enter Response Here> 11.3.1.b Examine internal scan report results from each scan and rescan run in the last 12 months to verify that all high-risk and critical vulnerabilities (identified in PCI DSS Requirement 6.3.1) are resolved.

<Enter Response Here> 11.3.1.c Examine scan tool configurations and interview personnel to verify that the scan tool is kept up to date with the latest vulnerability information.

Identify the evidence reference number(s) from Section 6 for all scan tool configurations examined for this testing procedure.

<Enter Response Here> 11.3.1.d Interview responsible personnel to verify that the scan was performed by a qualified internal resource(s) or qualified external third party and that organizational independence of the tester exists.

PCI DSS Requirement 11.3.1.1 All …

Removed p. 380

<Enter Response Here> 11.3.1.1.b Interview responsible personnel and examine internal scan report results or other documentation to verify that all other applicable vulnerabilities (those not ranked as high-risk or critical per the entity’s vulnerability risk rankings at Requirement 6.3.1) are addressed based on the risk defined in the entity’s targeted risk analysis, and that the scan process includes rescans as needed to confirm the vulnerabilities have been addressed.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all internal scan report results or other documentation examined for this testing procedure.

PCI DSS Requirement 11.3.1.2 Internal vulnerability scans are performed via authenticated scanning as follows:

• Systems that are unable to accept credentials for authenticated scanning are documented.

• Sufficient privileges are used for those systems that accept credentials for scanning.

• If accounts used for authenticated scanning can be used for interactive login, they are managed in accordance with Requirement 8.2.2. Note: …

Removed p. 382

<Enter Response Here> 11.3.1.2.b Examine scan report results and interview personnel to verify that authenticated scans are performed.

Identify the evidence reference number(s) from Section 6 for all examine scan report results examined for this testing procedure.

<Enter Response Here> 11.3.1.2.c If accounts used for authenticated scanning can be used for interactive login, examine the accounts and interview personnel to verify the accounts are managed following all elements specified in Requirement 8.2.2.

Identify the evidence reference number(s) from Section 6 for all accounts examined for this testing procedure.

<Enter Response Here> 11.3.1.2.d Examine documentation to verify that systems that are unable to accept credentials for authenticated scanning are defined.

• High-risk and critical vulnerabilities (per the entity's vulnerability risk rankings defined at Requirement 6.3.1) are resolved.

PCI DSS Requirement 11.3.1.3 Internal vulnerability scans are performed after any significant change as follows:

• Rescans are conducted as needed.

• Scans are performed by qualified personnel and organizational independence of …

Removed p. 384

Identify the evidence reference number(s) from Section 6 for all change control documentation examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all internal scan reports examined for this testing procedure.

<Enter Response Here> 11.3.1.3.b Interview personnel and examine internal scan and rescan reports to verify that internal scans were performed after significant changes and that high-risk and critical vulnerabilities as defined in Requirement 6.3.1 were resolved.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all internal scan and rescan reports examined for this testing procedure.

<Enter Response Here> 11.3.1.3.c Interview personnel to verify that internal scans are performed by a qualified internal resource(s) or qualified external third party and that organizational independence of the tester exists.

• At least once every three months.

PCI DSS Requirement 11.3.2 External vulnerability scans are performed as follows:

• By PCI SSC Approved Scanning Vendor (ASV).

• Vulnerabilities are …

Removed p. 386

Identify the evidence reference number(s) from Section 6 for all ASV scan reports examined for this testing procedure.

Identify the evidence reference number(s) from Section 6 for all ASV scan reports examined for this testing procedure.

<Enter Response Here> 11.3.2.b Examine the ASV scan report from each scan and rescan run in the last 12 months to verify that vulnerabilities are resolved and the ASV Program Guide requirements for a passing scan are met.

Identify the evidence reference number(s) from Section 6 for all ASV scan report results examined for this testing procedure.

<Enter Response Here> 11.3.2.c Examine the ASV scan reports to verify that the scans were completed by a PCI SSC Approved Scanning Vendor (ASV).

PCI DSS Requirement 11.3.2.1 External vulnerability scans are performed after any significant change as follows:

• Vulnerabilities that are scored 4.0 or higher by the CVSS are resolved.

Identify the evidence reference number(s) from Section 6 for all change control …

Removed p. 388

Requirement Description 11.4 External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected.

PCI DSS Requirement 11.4.1 A penetration testing methodology is defined, documented, and implemented by the entity and includes:

• Industry-accepted penetration testing approaches.

• Coverage for the entire CDE perimeter and critical systems.

• Testing from both inside and outside the network.

• Testing to validate any segmentation and scope-reduction controls.

• Application-layer penetration testing to identify, at a minimum, the vulnerabilities listed in Requirement 6.2.4.

• Network-layer penetration tests that encompass all components that support network functions as well as operating systems.

• Review and consideration of threats and vulnerabilities experienced in the last 12 months.

• Documented approach to assessing and addressing the risk posed by exploitable vulnerabilities and security weaknesses found during penetration testing.

• Retention of penetration testing results and remediation activities results for at least 12 months.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s …

Removed p. 391

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 11.4.2.a Examine the scope of work and results from the most recent internal penetration test to verify that penetration testing is performed in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for the scope of work examined for this testing procedure.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for the results from the most recent internal penetration test examined for this testing procedure.

<Enter Response Here> 11.4.2.b Interview personnel to verify that the internal penetration test was performed by a qualified internal resource or qualified external third- party and that organizational independence of the tester exists (not required to be a QSA or ASV).

• Per the entity's defined methodology

• At least once every 12 months

• After any significant infrastructure or application upgrade or change

PCI DSS Requirement 11.4.3 External penetration testing …

Removed p. 393

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for the results from the most recent external penetration test examined for this testing procedure.

<Enter Response Here> 11.4.3.b Interview personnel to verify that the external penetration test was performed by a qualified internal resource or qualified external third- party and that organizational independence of the tester exists (not required to be a QSA or ASV).

PCI DSS Requirement 11.4.4 Exploitable vulnerabilities and security weaknesses found during penetration testing are corrected as follows:

• In accordance with the entity's assessment of the risk posed by the security issue as defined in Requirement 6.3.1.

• Penetration testing is repeated to verify the corrections.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 11.4.4 Examine penetration testing results to verify that noted exploitable vulnerabilities and security weaknesses were corrected in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section …

Removed p. 400

Identify the evidence reference number(s) from Section 6 for all evidence examined for this testing procedure.

<Enter Response Here> Requirement Description 11.5 Network intrusions and unexpected file changes are detected and responded to.

PCI DSS Requirement 11.5.1 Intrusion-detection and/or intrusion-prevention techniques are used to detect and/or prevent intrusions into the network as follows:

• All traffic is monitored at the perimeter of the CDE.

• All traffic is monitored at critical points in the CDE.

• Personnel are alerted to suspected compromises.

• All intrusion-detection and prevention engines, baselines, and signatures are kept up to date.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 11.5.1.a Examine system configurations and network diagrams to verify that intrusion-detection and/or intrusion-prevention techniques are in place to monitor all traffic:

• At the perimeter of the CDE.

• At critical points in the CDE.

<Enter Response Here> 11.5.1.b Examine system configurations and interview responsible personnel to verify intrusion-detection and/or intrusion- prevention techniques …

Removed p. 402

PCI DSS Requirement 11.5.1.1 Additional requirement for service providers only: Intrusion-detection and/or intrusion-prevention techniques detect, alert on/prevent, and address covert malware communication channels. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 11.5.1.1.a Additional testing procedure for service provider assessments only: Examine documentation and configuration settings to verify that methods to detect and alert on/prevent covert malware communication channels are in place and operating.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all configuration settings examined for this testing procedure.

<Enter Response Here> 11.5.1.1.b Additional testing procedure for service provider assessments only: Examine the entity’s incident-response plan (Requirement 12.10.1) to verify it requires and defines a response in the event that covert malware communication channels are detected.

Identify the evidence reference …

Removed p. 405

11.5.2.b Examine settings for the change-detection mechanism to verify it is configured in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all settings for the change-detection mechanism examined for this testing procedure.

<Enter Response Here> Requirement Description 11.6 Unauthorized changes on payment pages are detected and responded to.

PCI DSS Requirement 11.6.1 A change- and tamper-detection mechanism is deployed as follows:

• To alert personnel to unauthorized modification (including indicators of compromise, changes, additions, and deletions) to the HTTP headers and the contents of payment pages as received by the consumer browser.

• The mechanism is configured to evaluate the received HTTP header and payment page.

• The mechanism functions are performed as follows:

• At least once every seven days OR

• Periodically (at the frequency defined in the entity's targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1). Note: This requirement is …

Removed p. 407

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all monitoring activities examined for this testing procedure.

<Enter Response Here> 11.6.1.b Examine configuration settings to verify the mechanism is configured in accordance with all elements specified in this requirement.

<Enter Response Here> 11.6.1.c If the mechanism functions are performed at an entity-defined frequency, examine the entity’s targeted risk analysis for determining the frequency to verify the risk analysis was performed in accordance with all elements specified at Requirement 12.3.1.

<Enter Response Here> 11.6.1.d Examine configuration settings and interview personnel to verify the mechanism functions are performed either:

• At the frequency defined in the entity’s targeted risk analysis performed for this requirement.

Removed p. 408

Requirement 12: Support Information Security with Organizational Policies and Programs Requirement Description 12.1 A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and current.

PCI DSS Requirement 12.1.1 An overall information security policy is:

• Disseminated to all relevant personnel, as well as to relevant vendors and business partners.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.1.1 Examine the information security policy and interview personnel to verify that the overall information security policy is managed in accordance with all elements specified in this requirement.

Removed p. 410

PCI DSS Requirement 12.1.2 The information security policy is:

• Reviewed at least once every 12 months.

• Updated as needed to reflect changes to business objectives or risks to the environment.

Removed p. 411

Identify the evidence reference number(s) from Section 6 for all information security policies examined for this testing procedure.

PCI DSS Requirement 12.1.3 The security policy clearly defines information security roles and responsibilities for all personnel, and all personnel are aware of and acknowledge their information security responsibilities.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.1.3.a Examine the information security policy to verify that they clearly define information security roles and responsibilities for all personnel.

<Enter Response Here> 12.1.3.b Interview personnel in various roles to verify they understand their information security responsibilities.

<Enter Response Here> 12.1.3.c Examine documented evidence to verify personnel acknowledge their information security responsibilities.

Identify the evidence reference number(s) from Section 6 for all documented evidence examined for this testing procedure.

PCI DSS Requirement 12.1.4 Responsibility for information security is formally assigned to a Chief Information Security Officer or other information security knowledgeable member of executive management.

Removed p. 414

<Enter Response Here> Requirement Description 12.2 Acceptable use policies for end-user technologies are defined and implemented.

PCI DSS Requirement 12.2.1 Acceptable use policies for end-user technologies are documented and implemented, including:

• Explicit approval by authorized parties.

• Acceptable uses of the technology.

• List of products approved by the company for employee use, including hardware and software.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.2.1 Examine the acceptable use policies for end-user technologies and interview responsible personnel to verify processes are documented and implemented in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all acceptable use policies examined for this testing procedure.

Removed p. 416

PCI DSS Requirement 12.3.1 Each PCI DSS requirement that provides flexibility for how frequently it is performed (for example, requirements to be performed periodically) is supported by a targeted risk analysis that is documented and includes:

• Identification of the assets being protected.

• Identification of the threat(s) that the requirement is protecting against.

• Identification of factors that contribute to the likelihood and/or impact of a threat being realized.

• Resulting analysis that determines, and includes justification for, how frequently the requirement must be performed to minimize the likelihood of the threat being realized.

• Review of each targeted risk analysis at least once every 12 months to determine whether the results are still valid or if an updated risk analysis is needed.

• Performance of updated risk analyses when needed, as determined by the annual review. Note: This requirement is a best practice until 31 March 2025, after which it will be required and …

Removed p. 419

PCI DSS Requirement 12.3.3 Cryptographic cipher suites and protocols in use are documented and reviewed at least once every 12 months, including at least the following:

• An up-to-date inventory of all cryptographic cipher suites and protocols in use, including purpose and where used.

• Active monitoring of industry trends regarding continued viability of all cryptographic cipher suites and protocols in use.

• A documented strategy to respond to anticipated changes in cryptographic vulnerabilities. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.3.3 Examine documentation for cryptographic suites and protocols in use and interview personnel to verify the documentation and review is in accordance with all elements specified in this requirement.

PCI DSS Requirement 12.3.4 Hardware and software technologies in use are reviewed at least …

Removed p. 428

PCI DSS Requirement 12.5.1 An inventory of system components that are in scope for PCI DSS, including a description of function/use, is maintained and kept current.

Removed p. 429

Identify the evidence reference number(s) from Section 6 for the inventory examined for this testing procedure.

<Enter Response Here> 12.5.1.b Interview personnel to verify the inventory is kept current.

PCI DSS Requirement 12.5.2 PCI DSS scope is documented and confirmed by the entity at least once every 12 months and upon significant change to the in-scope environment. At a minimum, the scoping validation includes:

• Identifying all data flows for the various payment stages (for example, authorization, capture settlement, chargebacks, and refunds) and acceptance channels (for example, card-present, card-not-present, and e-commerce).

• Updating all data-flow diagrams per Requirement 1.2.4.

• Identifying all locations where account data is stored, processed, and transmitted, including but not limited to: 1) any locations outside of the currently defined CDE, 2) applications that process CHD, 3) transmissions between systems and networks, and 4) file backups.

• Identifying all system components in the CDE, connected to the CDE, or that could impact …

Removed p. 431

Identify the evidence reference number(s) from Section 6 for all documented results of scope reviews examined for this testing procedure.

PCI DSS Requirement 12.5.2.1 Additional requirement for service providers only: PCI DSS scope is documented and confirmed by the entity at least once every six months and upon significant change to the in-scope environment. At a minimum, the scoping validation includes all the elements specified in Requirement 12.5.2. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

Identify the evidence reference number(s) from Section 6 for all documented results of scope reviews examined for this testing procedure.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.5.2.1.a Additional testing procedure for service provider assessments only: Examine documented results of scope reviews and interview personnel to verify that reviews per Requirement 12.5.2 are performed:

• …

Removed p. 434

<Enter Response Here> 12.5.3.b Additional testing procedure for service provider assessments only: Examine documentation (for example, meeting minutes) and interview responsible personnel to verify that significant changes to organizational structure resulted in documented reviews that included all elements specified in this requirement, with results communicated to executive management.

Removed p. 435

PCI DSS Requirement 12.6.1 A formal security awareness program is implemented to make all personnel aware of the entity’s information security policy and procedures, and their role in protecting the cardholder data.

Removed p. 436

Identify the evidence reference number(s) from Section 6 for the security awareness program examined for this testing procedure.

PCI DSS Requirement 12.6.2 The security awareness program is:

• Reviewed at least once every 12 months, and

• Updated as needed to address any new threats and vulnerabilities that may impact the security of the entity's CDE, or the information provided to personnel about their role in protecting cardholder data. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.6.2 Examine security awareness program content, evidence of reviews, and interview personnel to verify that the security awareness program is in accordance with all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for all security awareness program content examined for this testing procedure.

<Enter …

Removed p. 439

Identify the evidence reference number(s) from Section 6 for all security awareness program records examined for this testing procedure.

<Enter Response Here> 12.6.3.b Examine security awareness program materials to verify the program includes multiple methods of communicating awareness and educating personnel.

Identify the evidence reference number(s) from Section 6 for all security awareness program materials examined for this testing procedure.

Identify the evidence reference number(s) from Section 6 for all security awareness program materials examined for this testing procedure.

<Enter Response Here> 12.6.3.c Interview personnel to verify they have completed awareness training and are aware of their role in protecting cardholder data.

<Enter Response Here> 12.6.3.d Examine security awareness program materials and personnel acknowledgments to verify that personnel acknowledge at least once every 12 months that they have read and understand the information security policy and procedures.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all personnel acknowledgments examined for this testing …

Removed p. 441

Identify the evidence reference number(s) from Section 6 for all security awareness training content examined for this testing procedure.

PCI DSS Requirement 12.6.3.2 Security awareness training includes awareness about the acceptable use of end-user technologies in accordance with Requirement 12.2.1. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

Identify the evidence reference number(s) from Section 6 for all security awareness training content examined for this testing procedure.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.6.3.2 Examine security awareness training content to verify it includes awareness about acceptable use of end-user technologies in accordance with Requirement 12.2.1.

<Enter Response Here> Requirement Description 12.7 Personnel are screened to reduce risks from insider threats.

PCI DSS Requirement 12.7.1 Potential personnel who will have access to the CDE are screened, within the constraints of local laws, …

Removed p. 445

12.8.1.b Examine documentation to verify that a list of all TPSPs is maintained that includes a description of the services provided.

PCI DSS Requirement 12.8.2 Written agreements with TPSPs are maintained as follows:

• Written agreements are maintained with all TPSPs with which account data is shared or that could affect the security of the CDE.

• Written agreements include acknowledgments from TPSPs that they are responsible for the security of account data the TPSPs possess or otherwise store, process, or transmit on behalf of the entity, or to the extent that they could impact the security of the entity's CDE.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.8.2.a Examine policies and procedures to verify that processes are defined to maintain written agreements with all TPSPs in accordance with all elements specified in this requirement.

<Enter Response Here> 12.8.2.b Examine written agreements with TPSPs to verify they are maintained in accordance …

Removed p. 449

12.8.4.b Examine documentation and interview responsible personnel to verify that the PCI DSS compliance status of each TPSP is monitored at least once every 12 months.

PCI DSS Requirement 12.8.5 Information is maintained about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between the TPSP and the entity.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.8.5.a Examine policies and procedures to verify that processes are defined to maintain information about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between both the TPSP and the entity.

<Enter Response Here> 12.8.5.b Examine documentation and interview personnel to verify the entity maintains information about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between both entities.

<Enter Response …

Removed p. 452

PCI DSS Requirement 12.9.2 Additional requirement for service providers only: TPSPs support their customers' requests for information to meet Requirements 12.8.4 and 12.8.5 by providing the following upon customer request:

• PCI DSS compliance status information for any service the TPSP performs on behalf of customers (Requirement 12.8.4).

• Information about which PCI DSS requirements are the responsibility of the TPSP and which are the responsibility of the customer, including any shared responsibilities (Requirement 12.8.5).

Removed p. 453

<Enter Response Here> Requirement Description 12.10 Suspected and confirmed security incidents that could impact the CDE are responded to immediately.

PCI DSS Requirement 12.10.1 An incident response plan exists and is ready to be activated in the event of a suspected or confirmed security incident. The plan includes, but is not limited to:

• Roles, responsibilities, and communication and contact strategies in the event of a suspected or confirmed security incident, including notification of payment brands and acquirers, at a minimum.

• Incident response procedures with specific containment and mitigation activities for different types of incidents.

• Business recovery and continuity procedures.

• Data backup processes.

• Analysis of legal requirements for reporting compromises.

• Coverage and responses of all critical system components.

• Reference or inclusion of incident response procedures from the payment brands.

Removed p. 455

Identify the evidence reference number(s) from Section 6 for all incident response plans examined for this testing procedure.

<Enter Response Here> 12.10.1.b Interview personnel and examine documentation from previously reported incidents or alerts to verify that the documented incident response plan and procedures were followed.

PCI DSS Requirement 12.10.2 At least once every 12 months, the security incident response plan is:

• Reviewed and the content is updated as needed.

• Tested, including all elements listed in Requirement 12.10.1.

• Tested, including all elements listed in Requirement 12.10.1.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.10.2 Interview personnel and review documentation to verify that, at least once every 12 months, the security incident response plan is:

• Reviewed and updated as needed.

PCI DSS Requirement 12.10.3 Specific personnel are designated to be available on a 24/7 basis to respond to suspected or confirmed security incidents.

Removed p. 458

PCI DSS Requirement 12.10.4 Personnel responsible for responding to suspected and confirmed security incidents are appropriately and periodically trained on their incident response responsibilities.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.10.4 Examine training documentation and interview incident response personnel to verify that personnel are appropriately and periodically trained on their incident response responsibilities.

PCI DSS Requirement 12.10.4.1 The frequency of periodic training for incident response personnel is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.10.4.1.a Examine the entity’s targeted risk analysis for the frequency of training for incident response personnel to verify the risk analysis was performed in accordance …

Removed p. 462

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all observation(s) of incident response processes for this testing procedure.

PCI DSS Requirement 12.10.6 The security incident response plan is modified and evolved according to lessons learned and to incorporate industry developments.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 12.10.6.a Examine policies and procedures to verify that processes are defined to modify and evolve the security incident response plan according to lessons learned and to incorporate industry developments.

<Enter Response Here> 12.10.6.b Examine the security incident response plan and interview responsible personnel to verify that the incident response plan is modified and evolved according to lessons learned and to incorporate industry developments.

Identify the evidence reference number(s) from Section 6 for the security incident response plan examined for this testing procedure.

PCI DSS Requirement 12.10.7 Incident response procedures are in place, to be initiated upon the detection of stored …

Removed p. 465

Identify the evidence reference number(s) from Section 6 for the documented incident response procedures examined for this testing procedure.

<Enter Response Here> 12.10.7.b Interview personnel and examine records of response actions to verify that incident response procedures are performed upon detection of stored PAN anywhere it is not expected.

<Enter Response Here> Identify the evidence reference number(s) from Section 6 for all records of response actions examined for this testing procedure.

<Enter Response Here> Appendix A Additional PCI DSS Requirements A1 Additional PCI DSS Requirements for Multi-Tenant Service Providers Requirement Description A1.1 Multi-tenant service providers protect and separate all customer environments and data.

PCI DSS Requirement A1.1.1 Logical separation is implemented as follows:

• The provider cannot access its customers' environments without authorization.

• Customers cannot access the provider's environment without authorization. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a …

Removed p. 467

PCI DSS Requirement A1.1.2 Controls are implemented such that each customer only has permission to access its own cardholder data and CDE.

Removed p. 468

<Enter Response Here> A1.1.2.b Examine system configurations to verify that customers have privileges established to only access their own account data and CDE.

PCI DSS Requirement A1.1.3 Controls are implemented such that each customer can only access resources allocated to them.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response A1.1.3 Examine customer privileges to verify each customer can only access resources allocated to them.

Identify the evidence reference number(s) from Section 6 for all customer privileges examined for this testing procedure.

PCI DSS Requirement A1.1.4 The effectiveness of logical separation controls used to separate customer environments is confirmed at least once every six months via penetration testing. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

Identify the evidence reference number(s) from Section 6 for the results from the most recent penetration test examined …

Removed p. 473

Identify the evidence reference number(s) from Section 6 for the documented procedures examined for this testing procedure.

PCI DSS Requirement A1.2.3 Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities, including:

• Customers can securely report security incidents and vulnerabilities to the provider.

• The provider addresses and remediates suspected or confirmed security incidents and vulnerabilities according to Requirement 6.3.1. Note: This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.

Identify the evidence reference number(s) from Section 6 for the documented procedures examined for this testing procedure.

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response A1.2.3 Examine documented procedures and interview personnel to verify that the provider has a mechanism for reporting and addressing suspected or confirmed security incidents and vulnerabilities, in accordance with all elements specified in …

Removed p. 475

PCI DSS Requirement A2.1.1 Where POS POI terminals at the merchant or payment acceptance location use SSL and/or early TLS, the entity confirms the devices are not susceptible to any known exploits for those protocols.

Removed p. 476

PCI DSS Requirement A2.1.2 Additional requirement for service providers only: All service providers with existing connection points to POS POI terminals that use SSL and/or early TLS as defined in A2.1 have a formal Risk Mitigation and Migration Plan in place that includes:

• Description of usage, including what data is being transmitted, types and number of systems that use and/or support SSL/early TLS, and type of environment.

• Risk-assessment results and risk-reduction controls in place.

• Description of processes to monitor for new vulnerabilities associated with SSL/early TLS.

• Description of change control processes that are implemented to ensure SSL/early TLS is not implemented into new environments.

• Overview of migration project plan to replace SSL/early TLS at a future date.

Removed p. 477

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response A2.1.2 Additional testing procedure for service provider assessments only: Review the documented Risk Mitigation and Migration Plan to verify it includes all elements specified in this requirement.

Identify the evidence reference number(s) from Section 6 for the documented Risk Mitigation and Migration Plan examined for this testing procedure.

PCI DSS Requirement A2.1.3 Additional requirement for service providers only: All service providers provide a secure service offering.

Removed p. 478

<Enter Response Here> Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response A2.1.3 Additional testing procedure for service provider assessments only: Examine system configurations and supporting documentation to verify the service provider offers a secure protocol option for its service.

Removed p. 479

Entities that are required to validate to these requirements should refer to the following documents for reporting:

 PCI DSS v4.0 Supplemental Report on Compliance Template - Designated Entities Supplemental Validation  PCI DSS v4.0 Supplemental Attestation of Compliance for Report on Compliance - Designated Entities Supplemental Validation These documents are available in the PCI SSC Document Library.

Note that an entity is ONLY required to undergo an assessment according to this Appendix if instructed to do so by an acquirer or a payment brand.

Removed p. 480

Compensating controls must satisfy the following criteria:

1. Meet the intent and rigor of the original PCI DSS requirement.

2. Provide a similar level of defense as the original PCI DSS requirement, such that the compensating control sufficiently offsets the risk that the original PCI DSS requirement was designed to defend against. To understand the intent of a requirement, see the Customized Approach Objective for most PCI DSS requirements. If a requirement is not eligible for the Customized Approach and therefore does not have a Customized Approach Objective, refer to the Purpose in the Guidance column for that requirement.

3. Be “above and beyond” other PCI DSS requirements. (Simply being in compliance with other PCI DSS requirements is not a compensating control.)

4. When evaluating “above and beyond” for compensating controls, consider the following:

Note: All compensating controls must be reviewed and validated for sufficiency by the assessor who conducts the PCI DSS assessment. The …

Removed p. 482

Note: Only entities that have legitimate and documented technological or business constraints can consider the use of compensating controls to achieve compliance.

Required Number and Definition: <Enter Response Here> Information Required Explanation

1. Constraints Document the legitimate technical or business constraints precluding compliance with the original requirement.

2. Definition of Compensating Define the compensating controls, explain how they address the objectives of the original control and the increased risk, if any.

3. Objective Define the objective of the original control (for example, the Customized Approach Objective).

<Enter Response Here> Identify the objective met by the compensating control (note: this can be, but is not required to be, the stated Customized Approach Objective for the PCI DSS requirement).

4. Identified Risk Identify any additional risk posed by the lack of the original control.

5. Validation of Compensating Controls Define how the compensating controls were validated and tested.

6. Maintenance Define process(es) and controls in place to maintain compensating controls.

Removed p. 483

The entity implementing a customized approach must satisfy the following criteria:

 Document and maintain evidence about each customized control, including all information specified in the Controls Matrix Template in Appendix E1 of the Payment Card Industry Data Security Standard (PCI DSS) Requirements and Testing Procedures.

 Perform and document a targeted risk analysis (PCI DSS Requirement 12.3.2) for each customized control, including all information specified in the Targeted Risk Analysis Template in Appendix E2 of the Payment Card Industry Data Security Standard (PCI DSS) Requirements and Testing Procedures.

 Perform testing of each customized control to prove effectiveness, and document testing performed, methods used, what was tested, when testing was performed, and results of testing in the controls matrix.

 Monitor and maintain evidence about the effectiveness of each customized control.

 Provide completed controls matrix(es), targeted risk analysis, testing evidence, and evidence of customized control effectiveness to its assessor.

The assessor performing an assessment …

Removed p. 484

 The use of the customized approach may be regulated by organizations that manage compliance programs (for example, payment brands and acquirers). Therefore, questions about use of a customized approach must be referred to those organizations, including, for example, whether an entity is required to use a QSA, or may use an ISA to complete an assessment using the customized approach.

Note: Compensating controls are not an option with the customized approach. Because the customized approach allows an entity to determine and design the controls needed to meet a requirement’s Customized Approach Objective, the entity is expected to effectively implement the controls it designed for that requirement without needing to also implement alternate, compensating controls.

Removed p. 485

Requirement Number and Definition: <Enter Response Here> Identify the customized control name / identifier for each control used to meet the Customized Approach Objective. (Note: use the Customized Control name from the assessed entity’s controls matrix) <Enter Response Here> Describe each control used to meet the Customized Approach Objective. (Note: Refer to the Payment Card Industry Data Security Standard (PCI DSS) Requirements and Testing Procedures for the Customized Approach Objective) <Enter Response Here> Describe how the control(s) meet the Customized Approach Objective. <Enter Response Here> Identify the Controls Matrix documentation reviewed that supports a customized approach for this requirement.

<Enter Response Here> Identify the Targeted Risk Analysis documentation reviewed that supports the customized approach for this requirement.

<Enter Response Here> Identify name(s) of the assessor(s) who attests that:

• The entity completed the Controls Matrix including all information specified in the Controls Matrix Template in Appendix E1 of Payment Card Industry Data Security …

Removed p. 486

<Enter Response Here> Identify all evidence examined for this testing procedure.

<Enter Response Here> Identify all evidence examined for this testing procedure.

<Enter Response Here> Describe the results of the testing performed by the assessor for this testing procedure and how these results verify the implemented controls meet the Customized Approach Objective.

<Enter Response Here> Document the testing procedures derived and performed by the assessor to validate the controls are maintained to ensure ongoing effectiveness; for example, how the entity monitors for control effectiveness and how control failures are detected, responded to, and the actions taken. Note 1: Technical reviews (for example, reviewing configuration settings, operating effectiveness, etc.) should be performed where possible and appropriate. Note 2: Add additional rows for each assessor-derived testing procedure, as needed. Ensure that all rows to the right of the “Assessor-derived testing procedure” are copied for each assessor-derived testing procedure that is added.

<Assessor-derived testing procedure> Identify what …

Document Comparison

From Revision History

Content Changes