Is the change-detection mechanism configured to alert Observe system settings and personnel to unauthorized modification (including monitored files changes, additions, and deletions) of critical system files, Review results from monitoring configuration files or content files, and do the tools activities perform critical file comparisons at least weekly? Note: For change detection purposes, critical are usually those that do not regularly change, but the modification of which could indicate a system compromise or risk of compromise. Change detection mechanisms such as monitoring products usually come pre-configured with critical files for the operating system. Other critical files, such as those for custom applications, must be evaluated and defined by the entity (that is the merchant or service provider). 11.5.1 Is a process in place to respond to any alerts generated by Examine system configuration the change-detection solution? settings Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security for all personnel Note: For the purposes of Requirement 12, refers to full-time part-time employees, temporary employees and personnel, and “personnel” contractors and consultants who are on the entity’s site or otherwise have access to the company’s site cardholder data environment. “resident” Response one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A 12.1 Is a security policy established, published, maintained, Review the information security policy and disseminated to all relevant personnel?
Is the change-detection mechanism configured to alert personnel to unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files or content files, and do the tools perform critical file comparisons at least weekly? Note: For change detection purposes, critical are usually those that do not regularly change, but the modification of which could indicate a system compromise or risk of compromise. Change detection mechanisms such as monitoring products usually come pre-configured with critical files for the operating system. Other critical files, such as those for custom applications, must be evaluated and defined by the entity (that is the merchant or service provider). Observe system settings and monitored files Review results from monitoring activities 11.5.1 Is a process in place to respond to any alerts generated by the change-detection solution? Examine system configuration settings Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security for all personnel Note: For the purposes of Requirement 12, “personnel” refers to full-time part-time employees, temporary employees and personnel, and contractors and consultants who are “resident” on the entity’s site or otherwise have access to the company’s site cardholder data environment. PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 12.1 Is a security policy established, published, maintained, and disseminated to all relevant personnel? Review the information security policy
PCI-DSS-v3_2-SAQ-A_EP.docx