Yes with Yes No N/A CCW (b) Are policies in place that state that unprotected PANs 4.2 Review policies and procedures are not to be sent via end-user messaging technologies? Implement Strong Access Control Measures Requirement 7: Restrict access to cardholder data by business need to know Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes No N/A CCW 7.1 Is access to system components and cardholder data limited to only individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: Examine written access control policy To least privileges necessary to perform job Interview personnel responsibilities? Interview management Assigned only to roles that specifically require that Review privileged user IDs privileged access? 7.1.3 Are access assigned based on individual personnel’s job Examine written access control policy classification and function? Interview management Review user IDs
Yes Yes with CCW No N/A 4.2 (b) Are policies in place that state that unprotected PANs are not to be sent via end-user messaging technologies? Review policies and procedures Implement Strong Access Control Measures Requirement 7: Restrict access to cardholder data by business need to know PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 7.1 Is access to system components and cardholder data limited to only individuals whose jobs require such access, as follows: 7.1.2 Is access to privileged user IDs restricted as follows: To least privileges necessary to perform job responsibilities? Assigned only to roles that specifically require that privileged access? Examine written access control policy Interview personnel Interview management Review privileged user IDs 7.1.3 Are access assigned based on individual personnel’s job classification and function? Examine written access control policy Interview management Review user IDs
cash-pic-saq-b-v3.docx