Is the current network diagram consistent with the Compare firewall configuration firewall configuration standards? standards to current network diagram 1.1.5 Are groups, roles, and responsibilities for logical Review firewall and router management of network components assigned and configuration standards documented in the firewall and router configuration Interview personnel standards? Do firewall and router configuration standards 1.1.6 Review firewall and router include a documented list of services, protocols, configuration standards and ports, including business justification and approval for each? Are all insecure services, protocols, and ports Review firewall and router identified, and are security features documented configuration standards and implemented for each identified service? Examine firewall and router configurations Do firewall and router configuration standards 1.1.7 Review firewall and router require review of firewall and router rule sets at configuration standards least every six months? Are firewall and router rule sets reviewed at least Examine documentation from every six months? firewall reviews 1.2 Do firewall and router configurations restrict connections between untrusted networks and any system in the cardholder data environment as follows: Note: An network” is any network that is “untrusted external to the networks belonging to the entity under review, and/or which is out of the entity’s ability to control or manage. Is inbound and outbound traffic restricted to that 1.2.1 Review firewall and router which is necessary for the cardholder data configuration standards environment? Examine firewall and router configurations
Is the current network diagram consistent with the firewall configuration standards? Compare firewall configuration standards to current network diagram 1.1.5 Are groups, roles, and responsibilities for logical management of network components assigned and documented in the firewall and router configuration standards? Review firewall and router configuration standards Interview personnel 1.1.6 Do firewall and router configuration standards include a documented list of services, protocols, and ports, including business justification and approval for each? Review firewall and router configuration standards Are all insecure services, protocols, and ports identified, and are security features documented and implemented for each identified service? Review firewall and router configuration standards Examine firewall and router configurations 1.1.7 Do firewall and router configuration standards require review of firewall and router rule sets at least every six months? Review firewall and router configuration standards Are firewall and router rule sets reviewed at least every six months? Examine documentation from firewall reviews 1.2 Do firewall and router configurations restrict connections between untrusted networks and any system in the cardholder data environment as follows: Note: An “untrusted network” is any network that is external to the networks belonging to the entity under review, and/or which is out of the entity’s ability to control or manage. 1.2.1 Is inbound and outbound traffic restricted to that which is necessary for the cardholder data environment? Review firewall and router configuration standards Examine firewall and router configurations
PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.docx