Section 2: Self-Assessment Questionnaire A-EP Note: The following questions are numbered according to PCI DSS requirements and testing procedures, as defined in the PCI DSS Requirements and Security Assessment Procedures document. Self-assessment completion date: Build and Maintain a Secure Network Requirement 1: Install and maintain a firewall configuration to protect data Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Are firewall and router configuration standards 1.1 established and implemented to include the following: Is there a formal process for approving and testing all 1.1.1 Review documented process network connections and changes to the firewall and Interview personnel router configurations? Examine network configurations (a) Is there a current network diagram that documents 1.1.2 Review current network diagram all connections between the cardholder data Examine network configurations environment and other networks, including any wireless networks? (b) Is there a process to ensure the diagram is kept Interview responsible personnel current? (a) Is there a current diagram that shows all cardholder 1.1.3 Review current dataflow diagram data flows across systems and networks? Examine network configurations. (b) Is a process to ensure the diagram is kept Interview personnel current? Is a firewall required and implemented at each 1.1.4 Review firewall configuration standards Internet connection and between any demilitarized Observe network configurations to zone (DMZ) and the internal network zone? verify that a firewall(s) is in place
Section 2: Self-Assessment Questionnaire A-EP Note: The following questions are numbered according to PCI DSS requirements and testing procedures, as defined in the PCI DSS Requirements and Security Assessment Procedures document. Self-assessment completion date: Build and Maintain a Secure Network Requirement 1: Install and maintain a firewall configuration to protect data PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 1.1 Are firewall and router configuration standards established and implemented to include the following: 1.1.1 Is there a formal process for approving and testing all network connections and changes to the firewall and router configurations? Review documented process Interview personnel Examine network configurations 1.1.2 (a) Is there a current network diagram that documents all connections between the cardholder data environment and other networks, including any wireless networks? Review current network diagram Examine network configurations (b) Is there a process to ensure the diagram is kept current? Interview responsible personnel 1.1.3 (a) Is there a current diagram that shows all cardholder data flows across systems and networks? Review current dataflow diagram Examine network configurations. (b) Is a process to ensure the diagram is kept current? Interview personnel 1.1.4 Is a firewall required and implemented at each Internet connection and between any demilitarized zone (DMZ) and the internal network zone? Review firewall configuration standards Observe network configurations to verify that a firewall(s) is in place
PCI-DSS-v3_2-SAQ-A_EP.docx