Is firmware on wireless devices updated to support Review policies and procedures strong encryption for authentication and transmission Review vendor documentation over wireless networks? Examine system configurations Are other security-related wireless vendor defaults Review policies and procedures changed, if applicable? Review vendor documentation Examine system configurations Are configuration standards developed for all system 2.2 Review system configuration components and are they consistent with standards system hardening standards? Review industry-accepted Sources of industry-accepted system hardening hardening standards standards may include, but are not limited to, SysAdmin Review policies and procedures Network Security (SANS) Institute, National Institute Interview personnel of Standards Technology (NIST), International Organization for Standardization (ISO), and Center for Internet Security (CIS). Are system configuration standards updated as new Review policies and procedures vulnerability issues are identified, as defined in Interview personnel Requirement 6.1? Are system configuration standards applied when Review policies and procedures new systems are configured? Interview personnel
Is firmware on wireless devices updated to support strong encryption for authentication and transmission over wireless networks? Review policies and procedures Review vendor documentation Examine system configurations Are other security-related wireless vendor defaults changed, if applicable? Review policies and procedures Review vendor documentation Examine system configurations 2.2 Are configuration standards developed for all system components and are they consistent with system hardening standards? Sources of industry-accepted system hardening standards may include, but are not limited to, SysAdmin Network Security (SANS) Institute, National Institute of Standards Technology (NIST), International Organization for Standardization (ISO), and Center for Internet Security (CIS). Review system configuration standards Review industry-accepted hardening standards Review policies and procedures Interview personnel Are system configuration standards updated as new vulnerability issues are identified, as defined in Requirement 6.1? Review policies and procedures Interview personnel Are system configuration standards applied when new systems are configured? Review policies and procedures Interview personnel
PCI-DSS-v3_2-SAQ-D_Merchant.docx