Methods for evaluating vulnerabilities and assigning risk ratings will vary based on an organization’s environment and risk strategy. Risk rankings should, at a minimum, identify all vulnerabilities considered to be a risk” to the “high environment. In addition to the risk ranking, vulnerabilities may be considered if they pose “critical” an imminent threat to the environment, impact critical systems, and/or would result in a potential compromise if not addressed. Examples of critical systems may include security systems, public-facing devices and systems, databases, and other systems that store, process or transmit cardholder data. Are all system components and software protected 6.2 Review policies and procedures from known vulnerabilities by installing applicable vendor-supplied security patches? Are critical security patches installed within one Review policies and procedures of release? Examine system components Note: Critical security patches should be identified Compare list of security patches according to the risk ranking process defined in installed to recent vendor patch lists Requirement 6.1. Are change-control procedures for implementing 6.4.5 Review change control processes security patches and software modifications and procedures documented and require the following? Documentation of impact Documented change control approval by authorized parties Functionality testing to verify that the change does not adversely impact the security of the system Back-out procedures Are the following performed and documented for all changes:
Methods for evaluating vulnerabilities and assigning risk ratings will vary based on an organization’s environment and risk strategy. Risk rankings should, at a minimum, identify all vulnerabilities considered to be a “high risk” to the environment. In addition to the risk ranking, vulnerabilities may be considered “critical” if they pose an imminent threat to the environment, impact critical systems, and/or would result in a potential compromise if not addressed. Examples of critical systems may include security systems, public-facing devices and systems, databases, and other systems that store, process or transmit cardholder data. 6.2 Are all system components and software protected from known vulnerabilities by installing applicable vendor-supplied security patches? Review policies and procedures Are critical security patches installed within one of release? Note: Critical security patches should be identified according to the risk ranking process defined in Requirement 6.1. Review policies and procedures Examine system components Compare list of security patches installed to recent vendor patch lists 6.4.5 Are change-control procedures for implementing security patches and software modifications documented and require the following? Documentation of impact Documented change control approval by authorized parties Functionality testing to verify that the change does not adversely impact the security of the system Back-out procedures Review change control processes and procedures Are the following performed and documented for all changes:
SAQ_A-EP_v3.docx