(b) Are critical security patches installed within one Review policies and procedures of release? Examine system components Note: Critical security patches should be identified Compare list of security patches according to the risk ranking process defined in installed to recent vendor patch Requirement 6.1. lists Implement Strong Access Control Measures Requirement 7: Restrict access to cardholder data by business need to know Response (Check one response for each PCI DSS Question Expected Testing question) Yes with Yes CCW No N/A 7.1 Is access to system components and cardholder data limited to only those individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: Examine written access control policy To least privileges necessary to perform job responsibilities? Interview personnel Assigned only to roles that specifically require that Interview management privileged access? Review privileged user IDs 7.1.3 Is access assigned based on individual personnel’s job Examine written access control classification and function? policy Interview management Review user IDs
(b) Are critical security patches installed within one of release? Note: Critical security patches should be identified according to the risk ranking process defined in Requirement 6.1. Review policies and procedures Examine system components Compare list of security patches installed to recent vendor patch lists Implement Strong Access Control Measures Requirement 7: Restrict access to cardholder data by business need to know PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 7.1 Is access to system components and cardholder data limited to only those individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: To least privileges necessary to perform job responsibilities? Assigned only to roles that specifically require that privileged access? Examine written access control policy Interview personnel Interview management Review privileged user IDs 7.1.3 Is access assigned based on individual personnel’s job classification and function? Examine written access control policy Interview management Review user IDs