2.3 Is non-console administrative access encrypted as follows: Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Is all non-console administrative access encrypted Examine system components with strong cryptography, and is a strong encryption Examine system configurations method invoked before the administrator’s password Observe an administrator log on is requested? Are system services and parameter files configured Examine system components to prevent the use of Telnet and other insecure Examine services and files remote login commands? Is administrator access to web-based management Examine system components interfaces encrypted with strong cryptography? Observe an administrator log on For the technology in use, is strong cryptography Examine system components implemented according to industry best practice Review vendor documentation and/or vendor recommendations? Interview personnel Protect Cardholder Data Requirement 3: Protect stored cardholder data Response (Check one response for each PCI DSS Question Expected Testing question) Yes with Yes CCW No N/A (c) Is sensitive authentication data deleted or 3.2 Review policies and procedures rendered unrecoverable upon completion of the Examine system configurations authorization process? Examine deletion processes
2.3 Is non-console administrative access encrypted as follows: Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Is all non-console administrative access encrypted with strong cryptography, and is a strong encryption method invoked before the administrator’s password is requested? Examine system components Examine system configurations Observe an administrator log on Are system services and parameter files configured to prevent the use of Telnet and other insecure remote login commands? Examine system components Examine services and files Is administrator access to web-based management interfaces encrypted with strong cryptography? Examine system components Observe an administrator log on For the technology in use, is strong cryptography implemented according to industry best practice and/or vendor recommendations? Examine system components Review vendor documentation Interview personnel Protect Cardholder Data Requirement 3: Protect stored cardholder data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 3.2 (c) Is sensitive authentication data deleted or rendered unrecoverable upon completion of the authorization process? Review policies and procedures Examine system configurations Examine deletion processes
PCI-DSS-v3_2-SAQ-A_EP.docx