Are methods in place to prevent the disclosure of 1.3.8 Examine firewall and router configurations private IP addresses and routing information to the Internet? Note: Methods to obscure IP addressing may include, but are not limited to: Network Address Translation (NAT) Placing servers containing cardholder data behind proxy servers/firewalls, Removal or filtering of advertisements for private networks that employ registered addressing, Internal use of RFC1918 address space instead of registered addresses. Is any disclosure of private IP addresses and Examine firewall and router configurations routing information to external entities authorized? Interview personnel Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Are vendor-supplied defaults always changed 2.1 Review policies and procedures before installing a system on the network? Examine vendor documentation This applies to ALL default passwords, including but Observe system configurations and not limited to those used by operating systems, account settings software that provides security services, application Interview personnel and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP) community strings, etc.).
1.3.8 Are methods in place to prevent the disclosure of private IP addresses and routing information to the Internet? Note: Methods to obscure IP addressing may include, but are not limited to: Network Address Translation (NAT) Placing servers containing cardholder data behind proxy servers/firewalls, Removal or filtering of advertisements for private networks that employ registered addressing, Internal use of RFC1918 address space instead of registered addresses. Examine firewall and router configurations Is any disclosure of private IP addresses and routing information to external entities authorized? Examine firewall and router configurations Interview personnel Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 2.1 Are vendor-supplied defaults always changed before installing a system on the network? This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP) community strings, etc.). Review policies and procedures Examine vendor documentation Observe system configurations and account settings Interview personnel
SAQ_A-EP_v3%20%285%29.docx