4.3 Are security policies and operational procedures for Review security policies and encrypting transmissions of cardholder data: operational procedures Documented Interview personnel In use Known to all affected parties? Maintain a Vulnerability Management Program Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Not Yes CCW No N/A Tested 5.1 Is anti-virus software deployed on all systems commonly Examine system configurations affected by malicious software? 5.1.1 Are programs capable of detecting, removing, and Review vendor documentation protecting against all known types of malicious software Examine system configurations (for example, viruses, Trojans, worms, spyware, adware, and rootkits)? 5.1.2 Are periodic evaluations performed to identify and evaluate Interview personnel evolving malware threats in order to confirm whether those systems considered to not be commonly affected by malicious software continue as such? 5.2 Are all mechanisms maintained as follows:
4.3 Are security policies and operational procedures for encrypting transmissions of cardholder data: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel Maintain a Vulnerability Management Program Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A Not Tested 5.1 Is anti-virus software deployed on all systems commonly affected by malicious software? Examine system configurations 5.1.1 Are programs capable of detecting, removing, and protecting against all known types of malicious software (for example, viruses, Trojans, worms, spyware, adware, and rootkits)? Review vendor documentation Examine system configurations 5.1.2 Are periodic evaluations performed to identify and evaluate evolving malware threats in order to confirm whether those systems considered to not be commonly affected by malicious software continue as such? Interview personnel 5.2 Are all mechanisms maintained as follows:
SAQ_D_v3_Merchant.docx