Requirement 11: Regularly test security systems and processes Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A 11.2.2 Are quarterly external vulnerability scans performed? Review results from the four most recent quarters of external vulnerability Note: Quarterly external vulnerability scans must be scans performed by an Approved Scanning Vendor (ASV), approved by the Payment Card Industry Security Standards Council (PCI SSC). Refer to the ASV Program Guide published on the PCI SSC website for scan customer responsibilities, scan preparation, etc. Do external quarterly scan and rescan results satisfy Review results of each external the ASV Program Guide requirements for a passing quarterly scan and rescan scan (for example, no vulnerabilities rated 4.0 or higher by the CVSS, and no automatic failures)? Are quarterly external vulnerability scans performed Review results of each external by a PCI SSC Approved Scanning Vendor (ASV? quarterly scan and rescan Are internal and external scans, and rescans as 11.2.3 Examine and correlate change control needed, performed after any significant change? documentation and scan reports Note: Scans must be performed by qualified personnel. Does the scan process include rescans until: Review scan reports For external scans, no vulnerabilities exist that are scored 4.0 or higher by the CVSS; For internal scans, a passing result is obtained or all vulnerabilities as defined in PCI “high-risk” DSS Requirement 6.1 are resolved? Are scans performed by a qualified internal Interview personnel resource(s) or qualified external third party, and if applicable, does organizational independence of the tester exist (not required to be a QSA or ASV)?
Requirement 11: Regularly test security systems and processes PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 11.2.2 Are quarterly external vulnerability scans performed? Note: Quarterly external vulnerability scans must be performed by an Approved Scanning Vendor (ASV), approved by the Payment Card Industry Security Standards Council (PCI SSC). Refer to the ASV Program Guide published on the PCI SSC website for scan customer responsibilities, scan preparation, etc. Review results from the four most recent quarters of external vulnerability scans Do external quarterly scan and rescan results satisfy the ASV Program Guide requirements for a passing scan (for example, no vulnerabilities rated 4.0 or higher by the CVSS, and no automatic failures)? Review results of each external quarterly scan and rescan Are quarterly external vulnerability scans performed by a PCI SSC Approved Scanning Vendor (ASV? Review results of each external quarterly scan and rescan 11.2.3 Are internal and external scans, and rescans as needed, performed after any significant change? Note: Scans must be performed by qualified personnel. Examine and correlate change control documentation and scan reports Does the scan process include rescans until: For external scans, no vulnerabilities exist that are scored 4.0 or higher by the CVSS; For internal scans, a passing result is obtained or all “high-risk” vulnerabilities as defined in PCI DSS Requirement 6.1 are resolved? Review scan reports Are scans performed by a qualified internal resource(s) or qualified external third party, and if applicable, does organizational independence of the tester exist (not required to be a QSA or ASV)? Interview personnel
SAQ_A-EP_v3%20%285%29.docx