For the technology in use, is strong Examine system components cryptography implemented according to Review vendor documentation industry best practice and/or vendor Interview personnel recommendations? [Fill out per your OST-approved 3rd vendor.] For POS POI terminals (and the SSL/TLS Review documentation that verifies POS termination points to which they connect) using POI devices are not susceptible to any SSL and/or early TLS and for which the entity known exploits for SSL/early TLS\ asserts are not susceptible to any known [Fill out per your OST-approved 3rd exploits for those protocols: vendor.] Is there documentation (for example, vendor documentation, system/network configuration details, etc.) that verifies the devices are not susceptible to any known exploits for SSL/early TLS? (f) For all other environments using SSL and/or Review Risk Mitigation and Migration early TLS: Plan Does the documented Risk Mitigation and [Fill out per your OST-approved 3rd party Migration Plan include the following? vendor.] Description of including; what data is being transmitted, types and number of systems that use and/or support SSL/early TLS, type of environment; Risk results and risk reduction controls in Description of processes to monitor for new vulnerabilities associated with SSL/early TLS; Description of change control processes that are implemented to ensure TLS is not implemented into new environments; Overview of migration project plan including target migration completion date no than 30th June 2016.
For the technology in use, is strong cryptography implemented according to industry best practice and/or vendor recommendations? Examine system components Review vendor documentation Interview personnel [Fill out per your OST-approved 3rd vendor.] For POS POI terminals (and the SSL/TLS termination points to which they connect) using SSL and/or early TLS and for which the entity asserts are not susceptible to any known exploits for those protocols: Is there documentation (for example, vendor documentation, system/network configuration details, etc.) that verifies the devices are not susceptible to any known exploits for SSL/early TLS? Review documentation that verifies POS POI devices are not susceptible to any known exploits for SSL/early TLS\ [Fill out per your OST-approved 3rd vendor.] (f) For all other environments using SSL and/or early TLS: Does the documented Risk Mitigation and Migration Plan include the following? Description of including; what data is being transmitted, types and number of systems that use and/or support SSL/early TLS, type of environment; Risk results and risk reduction controls in Description of processes to monitor for new vulnerabilities associated with SSL/early TLS; Description of change control processes that are implemented to ensure TLS is not implemented into new environments; Overview of migration project plan including target migration completion date no than 30th June 2016. Review Risk Mitigation and Migration Plan [Fill out per your OST-approved 3rd party vendor.]
saq_c_v3_1_instr.docx