Note: Risk rankings should be on industry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score and/or the classification by the vendor, and/or type of systems affected. Methods for evaluating vulnerabilities and assigning risk ratings will vary based on an organization’s environment and risk strategy. Risk rankings should, at a minimum, identify all vulnerabilities considered to be a risk” to the environment. In addition to the risk “high ranking, vulnerabilities may be considered if they “critical” pose an imminent threat to the environment, impact critical systems, and/or would result in a potential compromise if not addressed. Examples of critical systems may include security systems, public-facing devices and systems, databases, and other systems that store, process or transmit cardholder data. Are all system components and software protected 6.2 Review policies and procedures from known vulnerabilities by installing applicable vendor-supplied security patches? Are critical security patches installed within one month Review policies and procedures of release? Examine system components Note: Critical security patches should be identified Compare list of security patches according to the risk ranking process defined in installed to recent vendor patch Requirement 6.1. lists 6.4.6 Upon completion of a significant change, are all relevant Trace changes to change control PCI DSS requirements implemented on all new or documentation changed systems and networks, and documentation Examine change control updated as applicable? documentation Note: This requirement is a best practice until January 31, Interview personnel 2018, after which it becomes a requirement. Observe affected systems or networks
Note: Risk rankings should be on industry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score and/or the classification by the vendor, and/or type of systems affected. Methods for evaluating vulnerabilities and assigning risk ratings will vary based on an organization’s environment and risk strategy. Risk rankings should, at a minimum, identify all vulnerabilities considered to be a “high risk” to the environment. In addition to the risk ranking, vulnerabilities may be considered “critical” if they pose an imminent threat to the environment, impact critical systems, and/or would result in a potential compromise if not addressed. Examples of critical systems may include security systems, public-facing devices and systems, databases, and other systems that store, process or transmit cardholder data. 6.2 Are all system components and software protected from known vulnerabilities by installing applicable vendor-supplied security patches? Review policies and procedures Are critical security patches installed within one month of release? Note: Critical security patches should be identified according to the risk ranking process defined in Requirement 6.1. Review policies and procedures Examine system components Compare list of security patches installed to recent vendor patch lists 6.4.6 Upon completion of a significant change, are all relevant PCI DSS requirements implemented on all new or changed systems and networks, and documentation updated as applicable? Note: This requirement is a best practice until January 31, 2018, after which it becomes a requirement. Trace changes to change control documentation Examine change control documentation Interview personnel Observe affected systems or networks
SAQ_C.docx