Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Are vendor-supplied defaults always changed before 2.1 Review policies and procedures installing a system on the network? Examine vendor documentation This applies to ALL default passwords, including but not Observe system configurations and limited to those used by operating systems, software that account settings provides security services, application and system Interview personnel accounts, point-of-sale (POS) terminals, payment applications, Simple Network Management Protocol (SNMP) community strings, etc.). Are unnecessary default accounts removed or Review policies and procedures disabled before installing a system on the network? Review vendor documentation Examine system configurations and account settings Interview personnel Are configuration standards developed for all system 2.2 Review system configuration components and are they consistent with standards system hardening standards? Review industry-accepted Sources of industry-accepted system hardening hardening standards standards may include, but are not limited to, SysAdmin Review policies and procedures Audit Network Security (SANS) Institute, National Interview personnel Institute of Standards Technology (NIST), International Organization for Standardization (ISO), and Center for Internet Security (CIS). Are system configuration standards updated as new Review policies and procedures vulnerability issues are identified, as defined in Interview personnel Requirement 6.1? Are system configuration standards applied when Review policies and procedures new systems are configured? Interview personnel
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 2.1 Are vendor-supplied defaults always changed before installing a system on the network? This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, payment applications, Simple Network Management Protocol (SNMP) community strings, etc.). Review policies and procedures Examine vendor documentation Observe system configurations and account settings Interview personnel Are unnecessary default accounts removed or disabled before installing a system on the network? Review policies and procedures Review vendor documentation Examine system configurations and account settings Interview personnel 2.2 Are configuration standards developed for all system components and are they consistent with system hardening standards? Sources of industry-accepted system hardening standards may include, but are not limited to, SysAdmin Audit Network Security (SANS) Institute, National Institute of Standards Technology (NIST), International Organization for Standardization (ISO), and Center for Internet Security (CIS). Review system configuration standards Review industry-accepted hardening standards Review policies and procedures Interview personnel Are system configuration standards updated as new vulnerability issues are identified, as defined in Requirement 6.1? Review policies and procedures Interview personnel Are system configuration standards applied when new systems are configured? Review policies and procedures Interview personnel
SAQ_A-EP.docx