Has all unnecessary functionality—such as 2.2.5 Examine security parameters on system scripts, drivers, features, subsystems, file components systems, and unnecessary web servers—been removed? Are enabled functions documented and do they Review documentation support secure configuration? Examine security parameters on system components Is only documented functionality present on Review documentation system components? Examine security parameters on system components 2.3 Is non-console administrative access encrypted as follows: Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Is all non-console administrative access Examine system components encrypted with strong cryptography, and is a Examine system configurations strong encryption method invoked before the Observe an administrator log on administrator’s password is requested? Are system services and parameter files Examine system components configured to prevent the use of Telnet and Examine services and files other insecure remote login commands? Is administrator access to web-based Examine system components management interfaces encrypted with strong Observe an administrator log on cryptography? For the technology in use, is strong Examine system components cryptography implemented according to Review vendor documentation industry best practice and/or vendor Interview personnel recommendations?
2.2.5 Has all unnecessary functionality—such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers—been removed? Examine security parameters on system components Are enabled functions documented and do they support secure configuration? Review documentation Examine security parameters on system components Is only documented functionality present on system components? Review documentation Examine security parameters on system components 2.3 Is non-console administrative access encrypted as follows: Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Is all non-console administrative access encrypted with strong cryptography, and is a strong encryption method invoked before the administrator’s password is requested? Examine system components Examine system configurations Observe an administrator log on Are system services and parameter files configured to prevent the use of Telnet and other insecure remote login commands? Examine system components Examine services and files Is administrator access to web-based management interfaces encrypted with strong cryptography? Examine system components Observe an administrator log on For the technology in use, is strong cryptography implemented according to industry best practice and/or vendor recommendations? Examine system components Review vendor documentation Interview personnel
pci-dss-v3_2-saq-c-rev1_1.docx