1.3 Is direct public access prohibited between the Internet and any system component in the cardholder data environment, as follows: 1.3.4 Is outbound traffic from the cardholder data Examine firewall and router environment to the Internet explicitly authorized? configurations 1.3.5 Are only established connections permitted into the Examine firewall and router network? configurations Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Response (Check one response for each PCI DSS Question Expected Testing question) Yes with Yes CCW No N/A Are vendor-supplied defaults always changed 2.1 Review policies and procedures before installing a system on the network? Examine vendor documentation This applies to ALL default passwords, including but Observe system configurations and not limited to used by operating systems, account settings software that provides security services, application Interview personnel and system accounts, point-of-sale (POS) terminals, payment applications, Simple Network Management Protocol (SNMP) community strings, etc.). Are unnecessary default accounts removed or Review policies and procedures disabled before installing a system on the Review vendor documentation network? Examine system configurations and account settings Interview personnel
1.3 Is direct public access prohibited between the Internet and any system component in the cardholder data environment, as follows: 1.3.4 Is outbound traffic from the cardholder data environment to the Internet explicitly authorized? Examine firewall and router configurations 1.3.5 Are only established connections permitted into the network? Examine firewall and router configurations Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 2.1 Are vendor-supplied defaults always changed before installing a system on the network? This applies to ALL default passwords, including but not limited to used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, payment applications, Simple Network Management Protocol (SNMP) community strings, etc.). Review policies and procedures Examine vendor documentation Observe system configurations and account settings Interview personnel Are unnecessary default accounts removed or disabled before installing a system on the network? Review policies and procedures Review vendor documentation Examine system configurations and account settings Interview personnel
pci-dss-v3_2-saq-c-rev1_1.docx