11.4 Are intrusion-detection and/or intrusion-prevention Examine system configurations techniques that detect and/or prevent intrusions into the Examine network diagrams network in place to monitor all traffic: At the perimeter of the cardholder data environment, and At critical points in the cardholder data environment. Are intrusion-detection and/or intrusion-prevention Examine system configurations techniques configured to alert personnel of suspected Interview responsible personnel compromises? Are all intrusion-detection and engines, Examine IDS/IPS configurations baselines, and signatures kept up-to-date? Examine vendor documentation Is a change-detection mechanism (for example, 11.5 Observe system settings and monitoring tools) deployed to detect monitored files unauthorized modification (including changes, additions, Examine system configuration and deletions) of critical system files, configuration files, settings or content files? Examples of files that should be monitored include: System executables Application executables Configuration and parameter files Centrally stored, historical or archived, log, and audit files Additional critical determined by entity (for example, through risk assessment or other means)
11.4 Are intrusion-detection and/or intrusion-prevention techniques that detect and/or prevent intrusions into the network in place to monitor all traffic: At the perimeter of the cardholder data environment, and At critical points in the cardholder data environment. Examine system configurations Examine network diagrams Are intrusion-detection and/or intrusion-prevention techniques configured to alert personnel of suspected compromises? Examine system configurations Interview responsible personnel Are all intrusion-detection and engines, baselines, and signatures kept up-to-date? Examine IDS/IPS configurations Examine vendor documentation 11.5 Is a change-detection mechanism (for example, monitoring tools) deployed to detect unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files, or content files? Examples of files that should be monitored include: System executables Application executables Configuration and parameter files Centrally stored, historical or archived, log, and audit files Additional critical determined by entity (for example, through risk assessment or other means) Observe system settings and monitored files Examine system configuration settings
PCI-DSS-v3_2-SAQ-A_EP.docx