Requirement 6: Develop and maintain secure systems and applications Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Is a process to identify security vulnerabilities, 6.1 Review policies and procedures including the following: Interview personnel Using reputable outside sources for vulnerability Observe processes information? Assigning a risk ranking to vulnerabilities that includes identification of all risk and “high” “critical” vulnerabilities? Note: Risk rankings should be based on industry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score and/or the classification by the vendor, and/or type of systems affected. Methods for evaluating vulnerabilities and assigning risk ratings will vary based on an organization’s environment and risk strategy. Risk rankings should, at a minimum, identify all vulnerabilities considered to be a risk” to the environment. In addition to the risk “high ranking, vulnerabilities may be considered if they “critical” pose an imminent threat to the environment, impact critical systems, and/or would result in a potential compromise if not addressed. Examples of critical systems may include security systems, public-facing devices and systems, databases, and other systems that store, process or transmit cardholder data. Are all system components and software protected 6.2 Review policies and procedures from known vulnerabilities by installing applicable vendor-supplied security patches?
Requirement 6: Develop and maintain secure systems and applications PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 6.1 Is a process to identify security vulnerabilities, including the following: Using reputable outside sources for vulnerability information? Assigning a risk ranking to vulnerabilities that includes identification of all “high” risk and “critical” vulnerabilities? Note: Risk rankings should be based on industry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score and/or the classification by the vendor, and/or type of systems affected. Methods for evaluating vulnerabilities and assigning risk ratings will vary based on an organization’s environment and risk strategy. Risk rankings should, at a minimum, identify all vulnerabilities considered to be a “high risk” to the environment. In addition to the risk ranking, vulnerabilities may be considered “critical” if they pose an imminent threat to the environment, impact critical systems, and/or would result in a potential compromise if not addressed. Examples of critical systems may include security systems, public-facing devices and systems, databases, and other systems that store, process or transmit cardholder data. Review policies and procedures Interview personnel Observe processes 6.2 Are all system components and software protected from known vulnerabilities by installing applicable vendor-supplied security patches? Review policies and procedures
PCI-DSS-v3_2-SAQ-C_VT-rev1_1.docx