PART 4 PRICING SCHEDULE Requirement Frequency Affected Priority Report Reported PCI Scope Addresses or IPs Unit Cost Annual Cost Components Rating Format VPMG External Weekly External Critical Technical Critical / Daily Scan 50 IPs Vulnerability Internet Report High Issues Scan Facing Infrastructure Internal Quarterly Internal High Technical Critical / Monthly Scan 50 IPs Vulnerability network and High Issues Scan Executive Report Network Annually Zones of High Technical Critical / Quarterly 8000 firewall access rules and Filtering Different Trust Report High Issues 20 firewall instances Review Wireless Quarterly Wireless Critical Technical Critical / Quarterly Site surveys; network Security Scan Network Report High Issues reconnaissance, wireless infrastructure device security testing; Wireless Intrusion Prevention Systems and exploitation of identified vulnerabilities External Annually External High Technical Critical / Annually Externally Facing IP Addresses, Penetration Internet facing Report High Issues Remote Access Devices, Web Test infrastructure Servers with Dynamic Content and SOAP/XML/Web Services Servers based on the scope Internal Annually Internal High Technical Critical / Annually Automated vulnerability scans Penetration internet facing Report High Issues and basic validation on 1000
PART 4 PRICING SCHEDULE Requirement Frequency Affected Components Priority Rating Report Format Reported VPMG PCI Scope Addresses or IPs Unit Cost Annual Cost External Vulnerability Scan Weekly External Internet Facing Infrastructure Critical Technical Report Critical / High Issues Daily Scan 50 IPs Internal Vulnerability Scan Quarterly Internal network High Technical and Executive Report Critical / High Issues Monthly Scan 50 IPs Network Filtering Review Annually Zones of Different Trust High Technical Report Critical / High Issues Quarterly 8000 firewall access rules and 20 firewall instances Wireless Security Scan Quarterly Wireless Network Critical Technical Report Critical / High Issues Quarterly Site surveys; network reconnaissance, wireless infrastructure device security testing; Wireless Intrusion Prevention Systems and exploitation of identified vulnerabilities External Penetration Test Annually External Internet facing infrastructure High Technical Report Critical / High Issues Annually Externally Facing IP Addresses, Remote Access Devices, Web Servers with Dynamic Content and SOAP/XML/Web Services Servers based on the scope Internal Penetration Annually Internal internet facing High Technical Report Critical / High Issues Annually Automated vulnerability scans and basic validation on 1000
GSM_116_14___Request__for__proposal__xRFPx__for__a__Payment_Card_Industry_Data_Standard_Remediation_and_Compliance_Project_FIN.docx