5.3 Are all anti-virus mechanisms: Examine anti-virus configurations Actively running? Examine system components Unable to be disabled or altered by users? Observe processes Note: Anti-virus solutions may be temporarily disabled Interview personnel only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must be formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active. Requirement 6: Develop and maintain secure systems and applications Response one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A 6.1 Is a process to identify security vulnerabilities, Review policies and procedures including the following: Interview personnel Using reputable outside sources for vulnerability Observe processes information? Assigning a risk ranking to vulnerabilities that includes identification of all risk and “high” “critical” vulnerabilities? Note: Risk rankings should be based on industry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score and/or the classification by the vendor, and/or type of systems affected.
5.3 Are all anti-virus mechanisms: Actively running? Unable to be disabled or altered by users? Note: Anti-virus solutions may be temporarily disabled only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must be formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active. Examine anti-virus configurations Examine system components Observe processes Interview personnel Requirement 6: Develop and maintain secure systems and applications PCI DSS Question Expected Testing Response one response for each question) Yes Yes with CCW No N/A 6.1 Is a process to identify security vulnerabilities, including the following: Using reputable outside sources for vulnerability information? Assigning a risk ranking to vulnerabilities that includes identification of all “high” risk and “critical” vulnerabilities? Note: Risk rankings should be based on industry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score and/or the classification by the vendor, and/or type of systems affected. Review policies and procedures Interview personnel Observe processes
SAQ_A-EP_v3%20%285%29.docx