Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A Are vendor-supplied defaults always changed 2.1 Review policies and procedures before installing a system on the network? Examine vendor documentation This applies to ALL default passwords, including but not Observe system configurations and limited to those used by operating systems, software that account settings provides security services, application and system Interview personnel accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP) community strings, etc.). Are unnecessary default accounts removed or Review policies and procedures disabled before installing a system on the network? Review vendor documentation Examine system configurations and account settings Interview personnel 2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data, are ALL wireless vendor defaults changed at installations, as follows: Are encryption keys changed from default at Review policies and procedures installation, and changed anytime anyone with Review vendor documentation knowledge of the keys leaves the company or Interview personnel changes positions? Are default SNMP community strings on wireless Review policies and procedures devices changed at installation? Review vendor documentation Interview personnel Examine system configurations Are default passwords/passphrases on access Review policies and procedures points changed at installation? Interview personnel Examine system configurations
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A 2.1 Are vendor-supplied defaults always changed before installing a system on the network? This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP) community strings, etc.). Review policies and procedures Examine vendor documentation Observe system configurations and account settings Interview personnel Are unnecessary default accounts removed or disabled before installing a system on the network? Review policies and procedures Review vendor documentation Examine system configurations and account settings Interview personnel 2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data, are ALL wireless vendor defaults changed at installations, as follows: Are encryption keys changed from default at installation, and changed anytime anyone with knowledge of the keys leaves the company or changes positions? Review policies and procedures Review vendor documentation Interview personnel Are default SNMP community strings on wireless devices changed at installation? Review policies and procedures Review vendor documentation Interview personnel Examine system configurations Are default passwords/passphrases on access points changed at installation? Review policies and procedures Interview personnel Examine system configurations
cash-pic-saq-c-vt-v3.docx