7.2.3 Does the access control system(s) have a default Review vendor documentation setting? Examine configuration settings 7.3 Are security policies and operational procedures for Examine security policies and restricting access to cardholder data: operational procedures Documented Interview personnel In use to all affected parties? Requirement 8: Identify and authenticate access to system components Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Not Yes CCW No N/A Tested 8.1 Are policies and procedures for user identification management controls defined and in for users and administrators on all system components, as follows: 8.1.1 Are all assigned a unique ID before allowing them to Review password procedures access system components or cardholder data? Interview personnel 8.1.2 Are additions, deletions, and modifications of user IDs, Review password procedures credentials, and other identifier objects controlled such Examine privileged and general that user IDs are implemented only as authorized user IDs and associated (including with specified privileges)? authorizations Observe system settings
7.2.3 Does the access control system(s) have a default setting? Review vendor documentation Examine configuration settings 7.3 Are security policies and operational procedures for restricting access to cardholder data: Documented In use to all affected parties? Examine security policies and operational procedures Interview personnel Requirement 8: Identify and authenticate access to system components PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 8.1 Are policies and procedures for user identification management controls defined and in for users and administrators on all system components, as follows: 8.1.1 Are all assigned a unique ID before allowing them to access system components or cardholder data? Review password procedures Interview personnel 8.1.2 Are additions, deletions, and modifications of user IDs, credentials, and other identifier objects controlled such that user IDs are implemented only as authorized (including with specified privileges)? Review password procedures Examine privileged and general user IDs and associated authorizations Observe system settings
PCI-DSS-v3_2-SAQ-D-for-Chase-Mobile-v1.3.docx