(f) For all environments using SSL and/or early TLS: Review Risk Mitigation and Migration Plan Does the documented Risk Mitigation and Migration Plan include the following? Description of usage, including; what data is being transmitted, types and number of systems that use and/or support SSL/early TLS, type of environment; Risk assessment results and risk reduction controls in place; Description of processes to monitor for new vulnerabilities associated with SSL/early TLS; Description of change control processes that are implemented to ensure SSL/early TLS is not implemented into new environments; Overview of migration project plan including target migration completion date no later than 30th June 2016. 2.4 (a) Is an inventory maintained for systems components Examine system inventory that are in for PCI DSS, including a list of hardware and software components and a description of function/use for each? (b) Is the documented inventory kept current? Interview personnel 2.5 Are security policies and operational procedures for Review security policies and managing vendor defaults and security parameters: operational procedures Documented Interview personnel In use Known to all affected parties? 2.6 This requirement applies only to service providers. Protect Cardholder Data
(f) For all environments using SSL and/or early TLS: Does the documented Risk Mitigation and Migration Plan include the following? Description of usage, including; what data is being transmitted, types and number of systems that use and/or support SSL/early TLS, type of environment; Risk assessment results and risk reduction controls in place; Description of processes to monitor for new vulnerabilities associated with SSL/early TLS; Description of change control processes that are implemented to ensure SSL/early TLS is not implemented into new environments; Overview of migration project plan including target migration completion date no later than 30th June 2016. Review Risk Mitigation and Migration Plan 2.4 (a) Is an inventory maintained for systems components that are in for PCI DSS, including a list of hardware and software components and a description of function/use for each? Examine system inventory (b) Is the documented inventory kept current? Interview personnel 2.5 Are security policies and operational procedures for managing vendor defaults and security parameters: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel 2.6 This requirement applies only to service providers. Protect Cardholder Data
PCI_DSS_v3-1_SAQ_D_Merchant_rev1-1.docx