2.3 Is non-console administrative access encrypted as follows: Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed Is all non-console administrative access encrypted Examine system components with strong cryptography, and is a strong encryption Examine system configurations method invoked before the administrator’s password Observe an administrator log on is requested? Are system services and parameter files configured Examine system components to prevent the use of Telnet and other insecure Examine services and files remote login commands? Is administrator access to web-based management Examine system components interfaces encrypted with strong cryptography? Observe an administrator log on For the technology in use, is strong cryptography Examine system components implemented according to industry best practice Review vendor documentation and/or vendor recommendations? Interview personnel 2.4 (a) Is an inventory maintained for systems components Examine system inventory that are in scope for PCI DSS, including a list of hardware and software components and a description of function/use for each? (b) Is the documented inventory kept current? Interview personnel Are security policies and operational procedures for Review security policies and 2.5 managing vendor defaults and security parameters: operational procedures Documented Interview personnel In use Known to all affected parties? 2.6 This requirement applies only to service providers. Protect Cardholder Data
2.3 Is non-console administrative access encrypted as follows: Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed Is all non-console administrative access encrypted with strong cryptography, and is a strong encryption method invoked before the administrator’s password is requested? Examine system components Examine system configurations Observe an administrator log on Are system services and parameter files configured to prevent the use of Telnet and other insecure remote login commands? Examine system components Examine services and files Is administrator access to web-based management interfaces encrypted with strong cryptography? Examine system components Observe an administrator log on For the technology in use, is strong cryptography implemented according to industry best practice and/or vendor recommendations? Examine system components Review vendor documentation Interview personnel 2.4 (a) Is an inventory maintained for systems components that are in scope for PCI DSS, including a list of hardware and software components and a description of function/use for each? Examine system inventory (b) Is the documented inventory kept current? Interview personnel 2.5 Are security policies and operational procedures for managing vendor defaults and security parameters: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel 2.6 This requirement applies only to service providers. Protect Cardholder Data