{"text_format":"1","workbook":"xlsx","n_sheets":19,"sheets":["Introduction","1","2","3","4","5","6","7","8","9","10","11","12","A.1","Not in place","Maturity graphs","CCWs","CCW Template","Sample CHD Flow"],"not_rendered":{"charts":13,"images":2,"macros":1,"external_links":0,"defined_names":76,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":40,"n_cols":31,"rows_kept":40,"cut":false,"hidden":false,"merged":[]}
[null,null,null,null,null,null,null,null,"Author: Daniel Andersson - PCI Professional (PCIP) and Certified Information Security Manager (CISM)",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Not performed","NOT OK","Not performed",0,"YES"]
[null,null,null,null,null,null,null,null,"Contact information: Phone +46 708 51 4854 ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Performed Informally","NOT OK","Performed Informally",1,"NO"]
[null,null,null,null,null,null,null,null,"E-mail : daniel.andersson@capsab.com",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Planned"," NOT OK","Planned",2]
[null,"www.capsab.com",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Well defined","OK","Well defined",3]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Quantitatively Controlled","OK","Quantitatively Controlled",4]
[null,"Introduction",null,null,null,null,null,null,null,null,null,null,null,null,null,"About CAPSAB",null,null,null,null,null,null,null,null,null,null,"Continuously Improving","OK","Continuously Improving",5]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"CAPSAB is a consultant firm specilised in cards and payments, "]
[null,"This Excel spreadsheet consists of several pages, the first twelve is per PCI DSS v3.0 chapter and",null,null,null,null,null,null,null,null,null,null,null,null,null,"our consultant has a background at banks, financial institutes and PSP all"]
[null,"consists of the official PCI DSS demands from PCI Security Standards Council (https://www.pcisecuritystandards.org/)",null,null,null,null,null,null,null,null,null,null,null,null,null,"with an upper management profile. One of our areas is information security "]
[null,"in each chapter page you must fill out your current state of compliance to get an overview of",null,null,null,null,null,null,null,null,null,null,null,null,null,"management, if you need assistance in becoming PCI DSS compliant please"]
[null,"your current state, each demand also includes possibility to add reference to policies and",null,null,null,null,null,null,null,null,null,null,null,null,null,"contact Daniel Andersson at daniel.andersson@capsab.com or +46 708 51 4854"]
[null,"documentation. I would recommend that you add these references as you will need them when"]
[null,"performing an audit. ",null,null,null,null,null,null,null,null,null,null,null,null,null,"Find us on LinkedIn"]
[]
[null,"To establish a good understanding of the security landscape in your organisation we use ISO 21827",null,null,null,null,null,null,null,null,null,null,null,null,null,"CAPSAB on LinkedIn",null,"https://www.linkedin.com/company/capsab?trk=tyah&trkInfo=tarId%3A1401716455216%2Ctas%3Acapsab%2Cidx%3A2-1-2"]
[null,"definitions to establish the maturity of the PCI DSS compliance, 6 levels is defined and to be PCI DSS"]
[null,"compliant it is not needed to comply to the highest level. Although a good security practice is to strive",null,null,null,null,null,null,null,null,null,null,null,null,null,"Daniel on LinkedIn",null,"http://linkd.in/1cq781L"]
[null,"to have a establish working process that allows your organisation to "]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"License and disclaimer"]
[null,"Not performed",null,"The demand is not met at all and there are no written procedures to"]
[null,null,null,"comply to this demand, could also indicate that you partitly comply.",null,null,null,null,null,null,null,null,null,null,null,"This Excel spreadsheet is free to use and distribute in its original form"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"all custom made code is copyrighted to CAPSAB and may not be"]
[null,"Performed Informally",null,"You perform the required tasks but it is not documented that you",null,null,null,null,null,null,null,null,null,null,null,"reproduced to be used in other projects without a prior written consent"]
[null,null,null,"do or that there is a policy demand to perform the tasks. No ",null,null,null,null,null,null,null,null,null,null,null,"from CAPSAB. The PCI DSS Requirements and standard is owned and "]
[null,null,null,"evidence in place that the task is repeated.",null,null,null,null,null,null,null,null,null,null,null,"managed by PCI Security Standards Council. Filling in the document does"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"not make you PCI DSS certified, it do prepare you for an certification and"]
[null,"Planned",null,"The task is planned, implmented and repeated, but no policy",null,null,null,null,null,null,null,null,null,null,null,"displays your organisations maturity to PCI DSS as percieved by the auditor."]
[null,null,null,"documentation exists. ",null,null,null,null,null,null,null,null,null,null,null,"The document do include macros, functions and other Excel features, all of"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"these are tested to eliminate errors, althoug there are no guarantees that all"]
[null,"Well defined",null,"The task is planned, implemented and repeated, and it is stated",null,null,null,null,null,null,null,null,null,null,null,"software errors has been found during the tests and there may still be bugs"]
[null,null,null,"in the organisations security policy that the the control must",null,null,null,null,null,null,null,null,null,null,null,"that currently are not known of."]
[null,null,null,"be in place."]
[]
[null,"Quantitatively Controlled",null,"A process is in place to follow up and meassure the result of the"]
[null,null,null,"implemented control to ensure its performance and make it"]
[null,null,null,"possible to evaluate and improve the processes."]
[]
[null,"Continuously Improving",null,"A process is in place to use the meassurements to improve"]
[null,null,null,"the control and its documentation, processes and policies. "]

{"sheet":"1","index":1,"n_rows":208,"n_cols":6,"rows_kept":208,"cut":false,"hidden":false,"merged":[[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[73,2,81,2],[73,1,81,1],[73,0,81,0],[109,4,111,4],[115,4,116,4],[115,5,116,5],[116,3,117,3],[109,2,117,2],[109,1,117,1],[109,0,117,0],[82,0,90,0],[91,4,93,4],[97,4,98,4],[97,5,98,5],[98,3,99,3],[91,2,99,2],[91,1,99,1],[91,0,99,0],[82,4,84,4],[88,4,89,4],[19,1,27,1],[19,0,27,0],[28,4,30,4],[10,4,12,4],[17,3,18,3],[10,0,18,0],[10,1,18,1],[10,2,18,2],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[8,3,9,3],[7,4,8,4],[7,5,8,5],[16,4,17,4],[16,5,17,5],[25,4,26,4],[25,5,26,5],[19,4,21,4],[26,3,27,3],[19,2,27,2],[34,5,35,5],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[35,3,36,3],[28,2,36,2],[28,1,36,1],[37,0,45,0],[37,1,45,1],[37,2,45,2],[28,0,36,0],[34,4,35,4],[46,4,48,4],[52,4,53,4],[52,5,53,5],[53,3,54,3],[46,2,54,2],[46,1,54,1],[46,0,54,0],[55,0,63,0],[64,4,66,4],[70,4,71,4],[70,5,71,5],[71,3,72,3],[64,2,72,2],[64,1,72,1],[64,0,72,0],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[55,2,63,2],[55,1,63,1],[88,5,89,5],[89,3,90,3],[82,2,90,2],[82,1,90,1],[127,4,129,4],[133,4,134,4],[133,5,134,5],[134,3,135,3],[127,0,135,0],[127,1,135,1],[118,2,135,2],[100,0,108,0],[118,4,120,4],[124,4,125,4],[124,5,125,5],[125,3,126,3],[118,1,126,1],[118,0,126,0],[100,4,102,4],[106,4,107,4],[106,5,107,5],[107,3,108,3],[100,2,108,2],[100,1,108,1],[136,0,144,0],[145,4,147,4],[151,4,152,4],[151,5,152,5],[152,3,153,3],[145,2,153,2],[145,1,153,1],[145,0,153,0],[136,4,138,4],[142,4,143,4],[142,5,143,5],[143,3,144,3],[136,2,144,2],[136,1,144,1],[154,0,162,0],[163,4,165,4],[169,4,170,4],[169,5,170,5],[170,3,171,3],[163,2,171,2],[163,1,171,1],[163,0,171,0],[154,4,156,4],[160,4,161,4],[160,5,161,5],[161,3,162,3],[154,2,162,2],[154,1,162,1],[172,0,180,0],[181,4,183,4],[187,4,188,4],[187,5,188,5],[188,3,189,3],[181,2,189,2],[181,1,189,1],[181,0,189,0],[172,4,174,4],[178,4,179,4],[178,5,179,5],[179,3,180,3],[172,2,180,2],[172,1,180,1],[190,0,198,0],[199,4,201,4],[205,4,206,4],[205,5,206,5],[206,3,207,3],[199,2,207,2],[199,0,207,0],[199,1,207,1],[190,4,192,4],[196,4,197,4],[196,5,197,5],[197,3,198,3],[190,2,198,2],[190,1,198,1]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["1.1 Establish and implement firewall and router configuration standards that include the following:","1.1 Inspect the firewall and router configuration standards and other documentation specified below and verify that standards are complete and implemented as follows: ","Firewalls and routers are key components of the architecture that controls entry to and exit from the network. These devices are software or hardware devices that block unwanted access and manage authorized access into and out of the network.\n\nConfiguration standards and procedures will help to ensure that the organization’s first line of defense in the protection of its data remains strong.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.1.1 A formal process for approving \nand testing all network connections \nand changes to the firewall and router \nconfigurations ","1.1.1.a Examine documented procedures to verify there is a formal process for testing and approval of all: \n\n. Network connections and \n. Changes to firewall and router configurations \n\n1.1.1.b For a sample of network connections, interview responsible personnel and examine records to verify that network connections were approved and tested. \n\n1.1.1.c Identify a sample of actual changes made to firewall and router configurations, compare to the change records, and \ninterview responsible personnel to verify the changes were approved and tested. ","A documented and implemented process for approving and testing all connections and changes to the firewalls and routers will help prevent security problems caused by misconfiguration of the network, router, or firewall. \n\nWithout formal approval and testing of changes, records of the changes might not be updated, which could lead to inconsistencies between network documentation and the actual \nconfiguration. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.1.2 Current network diagram that \nidentifies all connections between the \ncardholder data environment and other \nnetworks, including any wireless \nnetworks ","1.1.2.a Examine diagram(s) and observe network configurations to verify that a current network diagram exists and that it documents all connections to cardholder data, including any wireless networks. \n\n1.1.2.b Interview responsible personnel to verify that the diagram is kept current.","Network diagrams describe how networks are configured, and identify the location of all network devices. \n\nWithout current network diagrams, devices could be overlooked and be unknowingly left out of the security controls implemented for PCI DSS and \nthus be vulnerable to compromise.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.1.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.1.3 Current diagram that shows all \ncardholder data flows across systems \nand networks ","1.1.3 Examine data-flow diagram and interview personnel to \nverify the diagram: \n\n. Shows all cardholder data flows across systems and networks. \n. Is kept current and updated as needed upon changes to the environment. ","Cardholder data-flow diagrams identify the location of all cardholder data that is stored, processed, or transmitted within the network. \n\nNetwork and cardholder data-flow diagrams help an organization to understand and keep track of \nthe scope of their environment, by showing how cardholder data flows across networks and between individual systems and devices. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.1.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.1.4 Requirements for a firewall at \neach Internet connection and between \nany demilitarized zone (DMZ) and the \ninternal network zone ","1.1.4.a Examine the firewall configuration standards and verify that they include requirements for a firewall at each Internet \nconnection and between any DMZ and the internal network zone. \n\n1.1.4.b Verify that the current network diagram is consistent with the firewall configuration standards. \n\n1.1.4.c Observe network configurations to verify that a firewall is in place at each Internet connection and between any \ndemilitarized zone (DMZ) and the internal network zone, per the documented configuration standards and network \ndiagrams. ","Using a firewall on every Internet connection coming into (and out of) the network, and between any DMZ and the internal network, allows the organization to monitor and control access and \nminimizes the chances of a malicious individual obtaining access to the internal network via an unprotected connection. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.1.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.1.5 Description of groups, roles, and \nresponsibilities for management of \nnetwork components ","1.1.5.a Verify that firewall and router configuration standards include a description of groups, roles, and responsibilities for management of network components. \n\n1.1.5.b Interview personnel responsible for management of network components to confirm that roles and responsibilities \nare assigned as documented. ","This description of roles and assignment of responsibilities ensures that personnel are aware of who is responsible for the security of all \nnetwork components, and that those assigned to manage components are aware of their responsibilities. If roles and responsibilities are not formally assigned, devices could be left \nunmanaged. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.1.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.1.6 Documentation and business \njustification for use of all services, \nprotocols, and ports allowed, including \ndocumentation of security features \nimplemented for those protocols \nconsidered to be insecure. \n\nExamples of insecure services, \nprotocols, or ports include but are not \nlimited to FTP, Telnet, POP3, IMAP, \nand SNMP v1 and v2. ","1.1.6.a Verify that firewall and router configuration standards include a documented list of all services, protocols and ports, including business justification for each—for example, hypertext transfer protocol (HTTP) and Secure Sockets Layer \n(SSL), Secure Shell (SSH), and Virtual Private Network (VPN) protocols. \n\n1.1.6.b Identify insecure services, protocols, and ports allowed; and verify that security features are documented for \neach service. \n\n1.1.6.c Examine firewall and router configurations to verify that the documented security features are implemented for each insecure service, protocol, and port. ","Compromises often happen due to unused or insecure service and ports, since these often have known vulnerabilities and many organizations don’t patch vulnerabilities for the services, protocols, and ports they don't use (even though the vulnerabilities are still present). By clearly defining and documenting the services, protocols, and ports that are necessary for business, organizations can ensure that all other services, protocols, and ports are disabled or removed. \n\nIf insecure services, protocols, or ports are necessary for business, the risk posed by use of these protocols should be clearly understood and \naccepted by the organization, the use of the protocol should be justified, and the security features that allow these protocols to be used securely should be documented and implemented. If these insecure services, protocols, or ports are not necessary for business, \nthey should be disabled or removed. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.1.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.1.7 Requirement to review firewall \nand router rule sets at least every six \nmonths ","1.1.7.a Verify that firewall and router configuration standards require review of firewall and router rule sets at least every six months. \n\n1.1.7.b Examine documentation relating to rule set reviews and interview responsible personnel to verify that the rule sets \nare reviewed at least every six months. ","This review gives the organization an opportunity at least every six months to clean up any unneeded, outdated, or incorrect rules, and ensure that all rule sets allow only authorized \nservices and ports that match the documented business justifications. \n\nOrganizations with a high volume of changes to firewall and router rule sets may wish to consider performing reviews more frequently, to ensure \nthat the rule sets continue to meet the needs of the business. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.1.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.2 Build firewall and router \nconfigurations that restrict connections \nbetween untrusted networks and any \nsystem components in the cardholder \ndata environment. \n\nNote: An “untrusted network” is any \nnetwork that is external to the networks \nbelonging to the entity under review, \nand/or which is out of the entity's ability \nto control or manage. ","1.2 Examine firewall and router configurations and perform the \nfollowing to verify that connections are restricted between untrusted networks and system components in the cardholder \ndata environment: ","It is essential to install network protection between the internal, trusted network and any untrusted \nnetwork that is external and/or out of the entity’s ability to control or manage. Failure to implement \nthis measure correctly results in the entity being vulnerable to unauthorized access by malicious \nindividuals or software. \n\nFor firewall functionality to be effective, it must be properly configured to control and/or limit traffic into and out of the entity’s network.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.2.1 Restrict inbound and outbound \ntraffic to that which is necessary for the \ncardholder data environment, and \nspecifically deny all other traffic. ","1.2.1 Restrict inbound and outbound \ntraffic to that which is necessary for the \ncardholder data environment, and \nspecifically deny all other traffic. \n\n1.2.1.b Examine firewall and router configurations to verify that inbound and outbound traffic is limited to that which is \nnecessary for the cardholder data environment. \n\n1.2.1.c Examine firewall and router configurations to verify that all other inbound and outbound traffic is specifically denied, for example by using an explicit “deny all” or an implicit deny after allow statement. ","This requirement is intended to prevent malicious individuals from accessing the entity’s network via \nunauthorized IP addresses or from using services, protocols, or ports in an unauthorized manner (for example, to send data they've obtained from \nwithin your network out to an untrusted server.) \n\nImplementing a rule that denies all inbound and outbound traffic that is not specifically needed helps to prevent inadvertent holes that would \nallow unintended and potentially harmful traffic in or out. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.2.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.2.2 Secure and synchronize router \nconfiguration files. ","1.2.2.a Examine router configuration files to verify they are secured from unauthorized access. \n\n1.2.2.b Examine router configurations to verify they are synchronized—for example, the running (or active) configuration matches the start-up configuration (used when machines are booted). ","While the running (or active) router configuration files include the current, secure settings, the startup files (which are used when routers are re-\nstarted or booted) must be updated with the same secure settings to ensure these settings are applied when the start-up configuration is run. \n\nBecause they only run occasionally, start-up configuration files are often forgotten and are not updated. When a router re-starts and loads a \nstart-up configuration that has not been updated with the same secure settings as those in the running configuration, it may result in weaker rules that allow malicious individuals into the network. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.2.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.2.3 Install perimeter firewalls \nbetween all wireless networks and the \ncardholder data environment, and \nconfigure these firewalls to deny or, if \ntraffic is necessary for business \npurposes, permit only authorized traffic \nbetween the wireless environment and \nthe cardholder data environment. ","1.2.3.a Examine firewall and router configurations to verify that there are perimeter firewalls installed between all wireless networks and the cardholder data environment. \n\n1.2.3.b Verify that the firewalls deny or, if traffic is necessary for business purposes, permit only authorized traffic between \nthe wireless environment and the cardholder data environment. ","The known (or unknown) implementation and exploitation of wireless technology within a network is a common path for malicious \nindividuals to gain access to the network and cardholder data. If a wireless device or network is \ninstalled without the entity’s knowledge, amalicious individual could easily and “invisibly” enter the network. If firewalls do not restrict \naccess from wireless networks into the CDE, malicious individuals that gain unauthorized access to the wireless network can easily connect to the CDE and compromise account information. \n\nFirewalls must be installed between all wireless networks and the CDE, regardless of the purpose of the environment to which the wireless network is connected. This may include, but is not limited to, corporate networks, retail stores, guest networks, warehouse environments, etc. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.2.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.3 Prohibit direct public access \nbetween the Internet and any system \ncomponent in the cardholder data \nenvironment. ","1.3 Examine firewall and router configurations—including but not limited to the choke router at the Internet, the DMZ router and firewall, the DMZ cardholder segment, the perimeter router, \nand the internal cardholder network segment—and perform the following to determine that there is no direct access between the Internet and system components in the internal cardholder \nnetwork segment: ","A firewall's intent is to manage and control all connections between public systems and internal systems, especially those that store, process or \ntransmit cardholder data. If direct access is allowed between public systems and the CDE, the\nprotections offered by the firewall are bypassed, and system components storing cardholder data may be exposed to compromise. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.3.1 Implement a DMZ to limit \ninbound traffic to only system \ncomponents that provide authorized \npublicly accessible services, protocols, \nand ports. ","1.3.1 Examine firewall and router configurations to verify that a DMZ is implemented to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports. ","The DMZ is that part of the network that manages connections between the Internet (or other untrusted networks), and services that an \norganization needs to have available to the public (like a web server). \n\nThis functionality is intended to prevent malicious individuals from accessing the organization's internal network from the Internet, or from using services, protocols, or ports in an unauthorized manner. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.3.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.3.2 Limit inbound Internet traffic to IP \naddresses within the DMZ. ","1.3.2 Examine firewall and router configurations to verify that \ninbound Internet traffic is limited to IP addresses within the \nDMZ. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.3.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.3.3 Do not allow any direct \nconnections inbound or outbound for \ntraffic between the Internet and the \ncardholder data environment. ","1.3.3 Examine firewall and router configurations to verify direct \nconnections inbound or outbound are not allowed for traffic \nbetween the Internet and the cardholder data environment. ","Examination of all inbound and outbound connections allows for inspection and restriction of \ntraffic based on the source and/or destination address, as well as inspection and blocking of \nunwanted content, thus preventing unfiltered access between untrusted and trusted environments. This helps prevent, for example, malicious individuals from sending data they've \nobtained from within your network out to an external untrusted server in an untrusted network.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.3.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.3.4 Implement anti-spoofing \nmeasures to detect and block forged \nsource IP addresses from entering the \nnetwork. \n\n(For example, block traffic originating \nfrom the Internet with an internal \nsource address.) ","1.3.4 Examine firewall and router configurations to verify that anti-spoofing measures are implemented, for example internal addresses cannot pass from the Internet into the DMZ.","Normally a packet contains the IP address of the computer that originally sent it so other computers \nin the network know where the packet came from. Malicious individuals will often try to spoof (or imitate) the sending IP address so that the target \nsystem believes the packet is from a trusted source. \n\nFiltering packets coming into the network helps to, among other things, ensure packets are not “spoofed” to look like they are coming from an \norganization’s own internal network. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.3.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.3.5 Do not allow unauthorized \noutbound traffic from the cardholder \ndata environment to the Internet. ","1.3.5 Examine firewall and router configurations to verify that outbound traffic from the cardholder data environment to the Internet is explicitly authorized. ","All traffic outbound from the cardholder data environment should be evaluated to ensure that it \nfollows established, authorized rules. Connections should be inspected to restrict traffic to only authorized communications (for example by \nrestricting source/destination addresses/ports, and/or blocking of content). ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.3.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.3.6 Implement stateful inspection, \nalso known as dynamic packet \nfiltering. (That is, only “established” \nconnections are allowed into the \nnetwork.) ","1.3.6 Examine firewall and router configurations to verify that the firewall performs stateful inspection (dynamic packet filtering). (Only established connections should be allowed in, \nand only if they are associated with a previously established session.) ","A firewall that performs stateful packet inspection maintains the \"state\" (or the status) for each \nconnection through the firewall. By maintaining the “state,” the firewall knows whether an apparent response to a previous connection is actually a valid, authorized response (since it \nretains each connection’s status) or is malicious traffic trying to trick the firewall into allowing the \nconnection. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.3.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.3.7 Place system components that \nstore cardholder data (such as a \ndatabase) in an internal network zone, \nsegregated from the DMZ and other \nuntrusted networks. ","1.3.7 Examine firewall and router configurations to verify that system components that store cardholder data are on an internal network zone, segregated from the DMZ and other untrusted networks. ","If cardholder data is located within the DMZ, it is easier for an external attacker to access this \ninformation, since there are fewer layers to penetrate. Securing system components that store cardholder data in an internal network zone \nthat is segregated from the DMZ and other untrusted networks by a firewall can prevent unauthorized network traffic from reaching the \nsystem component. \n\nNote: This requirement is not intended to apply to temporary storage of cardholder data in volatile memory. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.3.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.3.8 Do not disclose private IP \naddresses and routing information to \nunauthorized parties. \n\nNote: Methods to obscure IP addressing \nmay include, but are not limited to: \n\n. Network Address Translation (NAT) \n. Placing servers containing \ncardholder data behind proxy \nservers/firewalls, \n. Removal or filtering of route \nadvertisements for private networks \nthat employ registered addressing, \n. Internal use of RFC1918 address \nspace instead of registered \naddresses. \n","1.3.8.a Examine firewall and router configurations to verify that methods are in place to prevent the disclosure of private IP addresses and routing information from internal networks to \nthe Internet. \n\n1.3.8.b Interview personnel and examine documentation to verify that any disclosure of private IP addresses and routing information to external entities is authorized. ","Restricting the disclosure of internal or private IP addresses is essential to prevent a hacker “learning” the IP addresses of the internal network, and using that information to access the \nnetwork. \n\nMethods used to meet the intent of this requirement may vary depending on the specific networking technology being used. For example, the controls used to meet this requirement may be \ndifferent for IPv4 networks than for IPv6 networks. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.3.8","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.4 Install personal firewall software on \nany mobile and/or employee-owned \ndevices that connect to the Internet \nwhen outside the network (for example, \nlaptops used by employees), and which \nare also used to access the network. \nFirewall configurations include: \n\n. Specific configuration settings are \ndefined for personal firewall software. \n. Personal firewall software is actively \nrunning. \n. Personal firewall software is not \nalterable by users of mobile and/or \nemployee-owned devices. ","1.4.a Examine policies and configuration standards to verify: \n\n. Personal firewall software is required for all mobile and/or employee-owned devices that connect to the Internet (for \nexample, laptops used by employees) when outside the network, and which are also used to access the network. \n. Specific configuration settings are defined for personal firewall software. \n. Personal firewall software is configured to actively run. \n. Personal firewall software is configured to not be alterable by users of mobile and/or employee-owned devices. \n\n1.4.b Inspect a sample of mobile and/or employee-owned devices to verify that: \n\n. Personal firewall software is installed and configured per the organization’s specific configuration settings. \n. Personal firewall software is actively running. \n. Personal firewall software is not alterable by users of mobile and/or employee-owned devices. ","Portable computing devices that are allowed to connect to the Internet from outside the corporate \nfirewall are more vulnerable to Internet-based threats. Use of a personal firewall helps to protect \ndevices from Internet-based attacks, which could use the device to gain access the organization’s \nsystems and data once the device is re-connected to the network. \n\nThe specific firewall configuration settings are determined by the organization. \n\nNote: The intent of this requirement applies to employee-owned and company-owned computers. Systems that cannot be managed by \ncorporate policy introduce weaknesses to the perimeter and provide opportunities that malicious \nindividuals may exploit. Allowing untrusted systems to connect to an organization’s network could result in access being granted to attackers and other malicious users. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["1.5 Ensure that security policies and \noperational procedures for managing \nfirewalls are documented, in use, and \nknown to all affected parties. ","1.5 Examine documentation and interview personnel to verify that security policies and operational procedures for managing \nfirewalls are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. ","Personnel need to be aware of and following security policies and operational procedures to \nensure firewalls and routers are continuously managed to prevent unauthorized access to the \nnetwork. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"1.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"2","index":2,"n_rows":109,"n_cols":6,"rows_kept":109,"cut":false,"hidden":false,"merged":[[16,5,17,5],[17,3,18,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[34,5,35,5],[35,3,36,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[52,5,53,5],[53,3,54,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4],[70,5,71,5],[71,3,72,3],[55,0,63,0],[55,1,63,1],[55,2,63,2],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[64,0,72,0],[64,1,72,1],[64,2,72,2],[64,4,66,4],[70,4,71,4],[88,5,89,5],[89,3,90,3],[73,0,81,0],[73,1,81,1],[73,2,81,2],[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[82,0,90,0],[82,1,90,1],[82,2,90,2],[82,4,84,4],[88,4,89,4],[106,5,107,5],[107,3,108,3],[91,0,99,0],[91,1,99,1],[91,2,99,2],[91,4,93,4],[97,4,98,4],[97,5,98,5],[98,3,99,3],[100,2,108,2],[100,0,108,0],[100,1,108,1],[100,4,102,4],[106,4,107,4]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["2.1 Always change vendor-supplied \ndefaults and remove or disable \nunnecessary default accounts before \ninstalling a system on the network. \n\nThis applies to ALL default passwords, \nincluding but not limited to those used by \noperating systems, software that \nprovides security services, application \nand system accounts, point-of-sale \n(POS) terminals, Simple Network \nManagement Protocol (SNMP) \ncommunity strings, etc.). \n","2.1.a Choose a sample of system components, and attempt to log on (with system administrator help) to the devices and applications using default vendor-supplied accounts and passwords, to verify that ALL default passwords (including those on operating systems, software that provides security services, application and system accounts, POS terminals, and Simple Network Management Protocol (SNMP) community strings) have been changed. (Use vendor manuals and sources on the Internet to find vendor-supplied accounts/passwords.) \n\n2.1.b For the sample of system components, verify that all unnecessary default accounts (including accounts used by operating systems, security software, applications, systems, POS terminals, SNMP, etc.) are removed or disabled. \n\n2.1.c Interview personnel and examine supporting documentation to verify that: \n\n. All vendor defaults (including default passwords on operating systems, software providing security services, application and system accounts, POS terminals, Simple Network Management Protocol (SNMP) community strings, etc.) are changed before a system is installed on the network. \n. Unnecessary default accounts (including accounts used by operating systems, security software, applications, systems, POS terminals, SNMP, etc.) are removed or disabled before B2 a system is installed on the network. ","Malicious individuals (external and internal to an organization) often use vendor default settings, account names, and passwords to compromise operating system software, applications, and the systems on which they are installed. Because these default settings are often published and are well known in hacker communities, changing these settings will leave systems less vulnerable to attack. \n\nEven if a default account is not intended to be used, changing the default password to a strong unique password and then disabling the account will prevent a malicious individual from re-enabling the account and gaining access with the default password. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data, change ALL wireless vendor defaults at installation, including but not limited to default wireless encryption keys, passwords, and SNMP \ncommunity strings. ","2.1.1.a Interview responsible personnel and examine supporting documentation to verify that: \n\n. Encryption keys were changed from default at installation \n. Encryption keys are changed anytime anyone with knowledge of the keys leaves the company or changes positions. \n\n2.1.1.b Interview personnel and examine policies and procedures to verify: \n\n. Default SNMP community strings are required to be changed upon installation. \n. Default passwords/phrases on access points are required to be changed upon installation. \n\n2.1.1.c Examine vendor documentation and login to wireless devices, with system administrator help, to verify: \n\n. Default SNMP community strings are not used. \n. Default passwords/passphrases on access points are not used. \n\n2.1.1.d Examine vendor documentation and observe wireless configuration settings to verify firmware on wireless devices is updated to support strong encryption for: \n\n. Authentication over wireless networks \n. Transmission over wireless networks. \n\n2.1.1.e Examine vendor documentation and observe wireless configuration settings to verify other security-related wireless vendor defaults were changed, if applicable. ","If wireless networks are not implemented with sufficient security configurations (including changing default settings), wireless sniffers can eavesdrop on the traffic, easily capture data and passwords, and easily enter and attack the network. \n\nIn addition, the key-exchange protocol for older versions of 802.11x encryption (Wired Equivalent Privacy, or WEP) has been broken and can render the encryption useless. Firmware for devices should be updated to support more secure protocols. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.2 Develop configuration standards for \nall system components. Assure that \nthese standards address all known \nsecurity vulnerabilities and are consistent \nwith industry-accepted system hardening \nstandards. \n\nSources of industry-accepted system \nhardening standards may include, but \nare not limited to: \n\n. Center for Internet Security (CIS) \n. International Organization for \nStandardization (ISO) \n. SysAdmin Audit Network Security \n(SANS) Institute \n. National Institute of Standards \nTechnology (NIST). ","2.2.a Examine the organization’s system configuration standards for all types of system components and verify the system configuration standards are consistent with industryaccepted hardening standards. \n\n2.2.b Examine policies and interview personnel to verify that system configuration standards are updated as new vulnerability issues are identified, as defined in Requirement 6.1. \n\n2.2.c Examine policies and interview personnel to verify that system configuration standards are applied when new systems are configured and verified as being in place before a system is installed on the network. \n\n2.2.d Verify that system configuration standards include the following procedures for all types of system components: \n\n. Changing of all vendor-supplied defaults and elimination of unnecessary default accounts \n. Implementing only one primary function per server to prevent functions that require different security levels from co-existing on the same server \n. Enabling only necessary services, protocols, daemons, etc., as required for the function of the system \n. Implementing additional security features for any required services, protocols or daemons that are considered to be insecure \n. Configuring system security parameters to prevent misuse \n. Removing all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers. ","There are known weaknesses with many operating systems, databases, and enterprise applications, and there are also known ways to configure these systems to fix security \nvulnerabilities. To help those that are not security experts, a number of security organizations have \nestablished system-hardening guidelines and recommendations, which advise how to correct \nthese weaknesses. \n\nExamples of sources for guidance on \nconfiguration standards include, but are not limited to: www.nist.gov, www.sans.org, and www.cisecurity.org, www.iso.org, and product vendors. \n\nSystem configuration standards must be kept up to date to ensure that newly identified weaknesses are corrected prior to a system being \ninstalled on the network. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.2.1 Implement only one primary \nfunction per server to prevent functions \nthat require different security levels \nfrom co-existing on the same server. \n(For example, web servers, database \nservers, and DNS should be \nimplemented on separate servers.) \n\nNote: Where virtualization technologies \nare in use, implement only one primary \nfunction per virtual system component. ","2.2.1.a Select a sample of system components and inspect the system configurations to verify that only one primary function is implemented per server. \n\n2.2.1.b If virtualization technologies are used, inspect the system configurations to verify that only one primary function is implemented per virtual system component or device. ","If server functions that need different security levels are located on the same server, the security level of the functions with higher security needs would be reduced due to the presence of the lower-security functions. Additionally, the server functions with a lower security level may introduce security weaknesses to other functions on the same server. By considering the security needs of different server functions as part of the system configuration standards and related processes, organizations can ensure that functions requiring different security levels don’t co-exist on the same server. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.21","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.2.2 Enable only necessary services, \nprotocols, daemons, etc., as required \nfor the function of the system. ","2.2.2.a Select a sample of system components and inspect enabled system services, daemons, and protocols to verify that only necessary services or protocols are enabled. \n\n2.2.2.b Identify any enabled insecure services, daemons, or protocols and interview personnel to verify they are justified \nper documented configuration standards. ","As stated in Requirement 1.1.6, there are many protocols that a business may need (or have enabled by default) that are commonly used by malicious individuals to compromise a network. Including this requirement as part of an organization's configuration standards and related processes ensures that only the necessary services and protocols are enabled. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.2.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.2.3 Implement additional security \nfeatures for any required services, \nprotocols, or daemons that are \nconsidered to be insecure—for \nexample, use secured technologies \nsuch as SSH, S-FTP, SSL, or IPSec \nVPN to protect insecure services such \nas NetBIOS, file-sharing, Telnet, FTP, \netc. ","2.2.3 Inspect configuration settings to verify that security features are documented and implemented for all insecure \nservices, daemons, or protocols. ","Enabling security features before new servers are deployed will prevent servers being installed into the environment with insecure configurations. \n\nEnsuring that all insecure services, protocols, and daemons are adequately secured with appropriate security features makes it more difficult for malicious individuals to take advantage of commonly used points of compromise within a network. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.2.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.2.4 Configure system security \nparameters to prevent misuse. ","2.2.4.a Interview system administrators and/or security managers to verify that they have knowledge of common security parameter settings for system components. \n\n2.2.4.b Examine the system configuration standards to verify that common security parameter settings are included. \n\n2.2.4.c Select a sample of system components and inspect the common security parameters to verify that they are set appropriately and in accordance with the configuration \nstandards. \n\n","System configuration standards and related processes should specifically address security settings and parameters that have known security implications for each type of system in use.\n\nIn order for systems to be configured securely, personnel responsible for configuration and/or administering systems must be knowledgeable in the specific security parameters and settings that apply to the system. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.2.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.2.5 Remove all unnecessary \nfunctionality, such as scripts, drivers, \nfeatures, subsystems, file systems, and \nunnecessary web servers. ","2.2.5.a Select a sample of system components and inspect the configurations to verify that all unnecessary functionality (for example, scripts, drivers, features, subsystems, file \nsystems, etc.) is removed. \n\n2.2.5.b. Examine the documentation and security parameters to verify enabled functions are documented and support \nsecure configuration. \n\n2.2.5.c. Examine the documentation and security parameters to verify that only documented functionality is present on the \nsampled system components. ","Unnecessary functions can provide additional opportunities for malicious individuals to gain access to a system. By removing unnecessary functionality, organizations can focus on securing the functions that are required and reduce the risk that unknown functions will be exploited. \n\nIncluding this in server-hardening standards and processes addresses the specific security implications associated with unnecessary functions (for example, by removing/disabling FTP or the web server if the server will not be performing those functions). ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.2.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.3 Encrypt all non-console \nadministrative access using strong \ncryptography. Use technologies such as \nSSH, VPN, or SSL/TLS for web-based \nmanagement and other non-console \nadministrative access. ","2.3 Select a sample of system components and verify that non-console administrative access is encrypted by performing the \nfollowing: \n\n2.3.a Observe an administrator log on to each system and examine system configurations to verify that a strong encryption method is invoked before the administrator’s \npassword is requested. \n\n2.3.b Review services and parameter files on systems to determine that Telnet and other insecure remote-login commands are not available for non-console access. \n\n2.3.c Observe an administrator log on to each system to verify that administrator access to any web-based management interfaces is encrypted with strong cryptography. \n\n2.3.d Examine vendor documentation and interview personnel to verify that strong cryptography for the technology in use is implemented according to industry best \npractices and/or vendor recommendations. ","If non-console (including remote) administration does not use secure authentication and encrypted communications, sensitive administrative or operational level information (like administrator’s IDs and passwords) can be revealed to an eavesdropper. A malicious individual could use this information to access the network, become administrator, and steal data. \n\nClear-text protocols (such as HTTP, telnet, etc.) do not encrypt traffic or logon details, making it easy for an eavesdropper to intercept this information. \n\nTo be considered “strong cryptography,” industryrecognized protocols with appropriate key strengths and key management should be in place as applicable for the type of technology in use. (Refer to \"strong cryptography” in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms.) ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.4 Maintain an inventory of system \ncomponents that are in scope for PCI \nDSS. ","2.4.a Examine system inventory to verify that a list of hardware and software components is maintained and includes a description of function/use for each. \n\n2.4.b Interview personnel to verify the documented inventory is kept current.","Maintaining a current list of all system \ncomponents will enable an organization to accurately and efficiently define the scope of their environment for implementing PCI DSS controls. Without an inventory, some system components could be forgotten, and be inadvertently excluded from the organization’s configuration standards. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.5 Ensure that security policies and \noperational procedures for managing \nvendor defaults and other security \nparameters are documented, in use, and \nknown to all affected parties. ","2.5 Examine documentation and interview personnel to verify that security policies and operational procedures for managing \nvendor defaults and other security parameters are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. ","Personnel need to be aware of and following security policies and daily operational procedures to ensure vendor defaults and other security parameters are continuously managed to prevent insecure configurations. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["2.6 Shared hosting providers must \nprotect each entity’s hosted environment \nand cardholder data. These providers \nmust meet specific requirements as \ndetailed in Appendix A: Additional PCI \nDSS Requirements for Shared Hosting \nProviders. ","2.6 Perform testing procedures A.1.1 through A.1.4 detailed in Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers for PCI DSS assessments of shared hosting providers, to verify that shared hosting providers protect their entities’ (merchants and service providers) hosted environment \nand data.","This is intended for hosting providers that provide shared hosting environments for multiple clients on the same server. When all data is on the same server and under control of a single environment, often the settings on these shared servers are not manageable by individual clients. This allows clients to add insecure functions and scripts that impact the security of all other client environments; and thereby make it easy for a malicious individual to compromise one client's data and thereby gain access to all other clients' data. See Appendix A for details of requirements.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"2.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"3","index":3,"n_rows":199,"n_cols":6,"rows_kept":199,"cut":false,"hidden":false,"merged":[[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[16,5,17,5],[17,3,18,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[34,5,35,5],[35,3,36,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4],[52,5,53,5],[53,3,54,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[64,0,72,0],[64,1,72,1],[64,2,72,2],[64,4,66,4],[70,4,71,4],[70,5,71,5],[71,3,72,3],[55,0,63,0],[55,1,63,1],[55,2,63,2],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[82,0,90,0],[82,1,90,1],[82,2,90,2],[82,4,84,4],[88,4,89,4],[88,5,89,5],[89,3,90,3],[73,0,81,0],[73,1,81,1],[73,2,81,2],[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[100,0,108,0],[100,1,108,1],[100,2,108,2],[100,4,102,4],[106,4,107,4],[106,5,107,5],[107,3,108,3],[91,0,99,0],[91,1,99,1],[91,2,99,2],[91,4,93,4],[97,4,98,4],[97,5,98,5],[98,3,99,3],[109,1,117,1],[109,0,117,0],[118,4,120,4],[124,4,125,4],[124,5,125,5],[125,3,126,3],[118,2,126,2],[118,1,126,1],[118,0,126,0],[109,4,111,4],[115,4,116,4],[115,5,116,5],[116,3,117,3],[109,2,117,2],[127,1,135,1],[127,0,135,0],[136,4,138,4],[142,4,143,4],[142,5,143,5],[143,3,144,3],[136,2,144,2],[136,1,144,1],[136,0,144,0],[127,4,129,4],[133,4,134,4],[133,5,134,5],[134,3,135,3],[127,2,135,2],[145,1,153,1],[145,0,153,0],[154,4,156,4],[160,4,161,4],[160,5,161,5],[161,3,162,3],[154,2,162,2],[154,1,162,1],[154,0,162,0],[145,4,147,4],[151,4,152,4],[151,5,152,5],[152,3,153,3],[145,2,153,2],[163,1,171,1],[163,0,171,0],[172,4,174,4],[178,4,179,4],[178,5,179,5],[179,3,180,3],[172,2,180,2],[172,0,180,0],[172,1,180,1],[163,4,165,4],[169,4,170,4],[169,5,170,5],[170,3,171,3],[163,2,171,2],[181,1,189,1],[181,0,189,0],[190,4,192,4],[196,4,197,4],[196,5,197,5],[197,3,198,3],[190,0,198,0],[190,1,198,1],[190,2,198,2],[181,4,183,4],[187,4,188,4],[187,5,188,5],[188,3,189,3],[181,2,189,2]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["3.1 Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures and processes that include at least the following for all cardholder data (CHD) \nstorage: \n\n. Limiting data storage amount and retention time to that which is required for legal, regulatory, and business requirements \n\n. Processes for secure deletion of data when no longer needed \n\n. Specific retention requirements for cardholder data \n\n. A quarterly process for identifying and securely deleting stored cardholder data that exceeds defined retention. ","3.1.a Examine the data retention and disposal policies, procedures and processes to verify they include at least the following: \n\n. Legal, regulatory, and business requirements for data retention, including \n. Specific requirements for retention of cardholder data (for example, cardholder data needs to be held for X period for Y business reasons). \n. Secure deletion of cardholder data when no longer needed for legal, regulatory, or business reasons \n. Coverage for all storage of cardholder data \n. A quarterly process for identifying and securely deleting stored cardholder data that exceeds defined retention requirements. \n\n3.1.b Interview personnel to verify that: \n\n. All locations of stored cardholder data are included in the data retention and disposal processes. \n. Either a quarterly automatic or manual process is in place to identify and securely delete stored cardholder data. \n. The quarterly automatic or manual process is performed for all locations of cardholder data. \n\n3.1.c For a sample of system components that store cardholder data: \n\n. Examine files and system records to verify that the data stored does not exceed the requirements defined in the data retention policy \n. Observe the deletion mechanism to verify data is deleted securely. ","A formal data retention policy identifies what data needs to be retained, and where that data resides so it can be securely destroyed or deleted as soon as it is no longer needed. \n\nThe only cardholder data that may be stored after authorization is the primary account number or PAN (rendered unreadable), expiration date, cardholder name, and service code. \n\nUnderstanding where cardholder data is located is necessary so it can be properly retained or disposed of when no longer needed. In order to define appropriate retention requirements, an entity first needs to understand their own business needs as well as any legal or regulatory obligations that apply to their industry, and/or that apply to the type of data being retained. \n\nIdentifying and deleting stored data that has exceeded its specified retention period prevents unnecessary retention of data that is no longer needed. This process may be automated or manual or a combination of both. For example, a programmatic proce-dure (automatic or manual) to locate and remove data and/or a manual review of data storage areas could be performed. \n\nImplementing secure deletion methods ensure that the data cannot be retrieved when it is no longer needed. \n\nRemember, if you don't need it, don't store it! ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.2 Do not store sensitive authentication \ndata after authorization (even if \nencrypted). If sensitive authentication \ndata is received, render all data \nunrecoverable upon completion of the \nauthorization process. \n\nIt is permissible for issuers and \ncompanies that support issuing services \nto store sensitive authentication data if: \n\n. There is a business justification and \n. The data is stored securely. \n\n\nSensitive authentication data includes \nthe data as cited in the following \nRequirements 3.2.1 through 3.2.3: ","3.2.a For issuers and/or companies that support issuing services and store sensitive authentication data, review policies and interview personnel to verify there is a documented business justification for the storage of sensitive authentication \ndata.\n\n3.2.b For issuers and/or companies that support issuing services and store sensitive authentication data, examine data stores and system configurations to verify that the sensitive authentication data is secured. \n\n3.2.c For all other entities, if sensitive authentication data is received, review policies and procedures, and examine system configurations to verify the data is not retained after authorization. \n\n3.2.d For all other entities, if sensitive authentication data is received, review procedures and examine the processes for securely deleting the data to verify that the data is unrecoverable. ","Sensitive authentication data consists of full track data, card validation code or value, and PIN data. Storage of sensitive authentication data after authorization is prohibited! This data is very valuable to malicious individuals as it allows them \nto generate counterfeit payment cards and create fraudulent transactions. \n\nEntities that issue payment cards or that perform or support issuing services will often create and control sensitive authentication data as part of the issuing function. It is allowable for companies that \nperform, facilitate, or support issuing services to store sensitive authentication data ONLY IF they have a legitimate business need to store such data. \n\nIt should be noted that all PCI DSS requirements apply to issuers, and the only exception for issuers and issuer processors is that sensitive authentication data may be retained if there is a legitimate reason to do so. A legitimate reason is one that is necessary for the performance of the \nfunction being provided for the issuer and not one of convenience. Any such data must be stored securely and in accordance with all PCI DSS and specific payment brand requirements. \n\nFor non-issuing entities, retaining sensitive \nauthentication data post-authentication is not permitted.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.2.1 Do not store the full contents of any track (from the magnetic stripe located on the back of a card, equivalent data contained on a chip, or \nelsewhere). This data is alternatively called full track, track, track 1, track 2, and magnetic-stripe data. \n\nNote: In the normal course of business, the following data elements from the magnetic stripe may need to be retained: \n\n. The cardholder’s name \n. Primary account number (PAN) \n. Expiration date \n. Service code \n\nTo minimize risk, store only these data \nelements as needed for business.","3.2.1 For a sample of system components, examine data sources including but not limited to the following, and verify that the full contents of any track from the magnetic stripe on the back of card or equivalent data on a chip are not stored after authorization: \n\n. Incoming transaction data \n. All logs (for example, transaction, history, debugging, error) \n. History files \n. Trace files \n. Several database schemas \n. Database contents. ","If full track data is stored, malicious individuals who obtain that data can use it to reproduce payment cards and complete fraudulent transactions. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.2.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.2.2 Do not store the card verification \ncode or value (three-digit or four-digit \nnumber printed on the front or back of \na payment card) used to verify card-\nnot-present transactions. ","3.2.2 For a sample of system components, examine data sources, including but not limited to the following, and verify that the three-digit or four-digit card verification code or value printed on the front of the card or the signature panel (CVV2, CVC2, CID, CAV2 data) is not stored after authorization: \n\n. Incoming transaction data \n. All logs (for example, transaction, history, debugging, error) \n. History files \n. Trace files \n. Several database schemas \n. Database contents. ","The purpose of the card validation code is to protect \"card-not-present\" transactions—Internet or mail order/telephone order (MO/TO) transactions—where the consumer and the card are not present. \n\nIf this data is stolen, malicious individuals can execute fraudulent Internet and MO/TO transactions. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.2.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.2.3 Do not store the personal identification number (PIN) or the encrypted PIN block. ","3.2.3 For a sample of system components, examine data sources, including but not limited to the following and verify that PINs and encrypted PIN blocks are not stored after authorization: \n\n. Incoming transaction data \n. All logs (for example, transaction, history, debugging, error) \n. History files \n. Trace files \n. Several database schemas \n. Database contents. ","These values should be known only to the card owner or bank that issued the card. If this data is stolen, malicious individuals can execute fraudulent PIN-based debit transactions (for example, ATM withdrawals). ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.2.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.3 Mask PAN when displayed (the first \nsix and last four digits are the maximum \nnumber of digits to be displayed), such \nthat only personnel with a legitimate \nbusiness need can see the full PAN. \n\n3.3 Mask PAN when displayed (the first \nsix and last four digits are the maximum \nnumber of digits to be displayed), such \nthat only personnel with a legitimate \nbusiness need can see the full PAN. ","3.3.a Examine written policies and procedures for masking the display of PANs to verify: \n\n. A list of roles that need access to displays of full PAN is documented, together with a legitimate business need for each role to have such access. \n. PAN must be masked when displayed such that only personnel with a legitimate business need can see the full PAN. \n. All other roles not specifically authorized to see the full PAN must only see masked PANs. \n\n3.3.b Examine system configurations to verify that full PAN is only displayed for users/roles with a documented business need, and that PAN is masked for all other requests. \n\n3.3.c Examine displays of PAN (for example, on screen, on paper receipts) to verify that PANs are masked when displaying cardholder data, and that only those with a legitimate business need are able to see full PAN. ","The display of full PAN on items such as computer screens, payment card receipts, faxes, or paper reports can result in this data being obtained by unauthorized individuals and used fraudulently. Ensuring that full PAN is only displayed for those with a legitimate business need to see the full PAN minimizes the risk of unauthorized persons gaining access to PAN data. \n\nThis requirement relates to protection of PAN displayed on screens, paper receipts, printouts, etc., and is not to be confused with Requirement 3.4 for protection of PAN when stored in files, databases, etc. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.4 Render PAN unreadable anywhere it \nis stored (including on portable digital \nmedia, backup media, and in logs) by \nusing any of the following approaches: \n\n. One-way hashes based on strong \ncryptography, (hash must be of the \nentire PAN) \n. Truncation (hashing cannot be used \nto replace the truncated segment of \nPAN) \n. Index tokens and pads (pads must be \nsecurely stored) \n. Strong cryptography with associated \nkey-management processes and \nprocedures. \n\n\nNote: It is a relatively trivial effort for a \nmalicious individual to reconstruct \noriginal PAN data if they have access to \nboth the truncated and hashed version of \na PAN. Where hashed and truncated \nversions of the same PAN are present in \nan entity’s environment, additional \ncontrols should be in place to ensure that \nthe hashed and truncated versions \ncannot be correlated to reconstruct the \noriginal PAN. ","3.4.a Examine documentation about the system used to protect the PAN, including the vendor, type of system/process, and the \nencryption algorithms (if applicable) to verify that the PAN is rendered unreadable using any of the following methods: \n\n. One-way hashes based on strong cryptography, \n. Truncation \n. Index tokens and pads, with the pads being securely stored \n. Strong cryptography, with associated key-management processes and procedures. \n\n3.4.b Examine several tables or files from a sample of data repositories to verify the PAN is rendered unreadable (that is, not stored in plain-text). \n\n3.4.c Examine a sample of removable media (for example, back-up tapes) to confirm that the PAN is rendered unreadable. \n\n3.4.d Examine a sample of audit logs to confirm that the PAN is rendered unreadable or removed from the logs. ","PANs stored in primary storage (databases, or flat files such as text files spreadsheets) as well as non-primary storage (backup, audit logs, exception or troubleshooting logs) must all be protected. \n\nOne-way hash functions based on strong cryptography can be used to render cardholder data unreadable. Hash functions are appropriate when there is no need to retrieve the original number (one-way hashes are irreversible). It is recommended, but not currently a requirement, that an additional, random input value be added to the cardholder data prior to hashing to reduce the feasibility of an attacker comparing the data against (and deriving the PAN from) tables of pre-computed hash values. \nThe intent of truncation is that only a portion (not to exceed the first six and last four digits) of the PAN is stored. \nAn index token is a cryptographic token that replaces the PAN based on a given index for an unpredictable value. A one-time pad is a system in which a randomly generated private key is used only once to encrypt a message that is then decrypted using a matching one-time pad and key. \n\nThe intent of strong cryptography (as defined in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms) is that the encryption be based on an industry-tested and accepted algorithm (not a proprietary or \"home-grown\" algorithm) with strong cryptographic keys. \n\nBy correlating hashed and truncated versions of a given PAN, a malicious individual may easily derive the original PAN value. Controls that prevent the correlation of this data will help ensure that the original PAN remains unreadable. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.4.1 If disk encryption is used (rather than file- or column-level database encryption), logical access must be managed separately and independently of native operatingsystem authentication and access control mechanisms (for example, by not using local user account databases or general network login credentials). Decryption keys must not be \nassociated with user accounts. ","3.4.1.a If disk encryption is used, inspect the configuration and observe the authentication process to verify that logical access to encrypted file systems is implemented via a mechanism that is separate from the native operating system’s authentication mechanism (for example, not using local user account databases or general network login credentials). \n\n3.4.1.b Observe processes and interview personnel to verify that cryptographic keys are stored securely (for example, stored on removable media that is adequately protected with strong access controls). \n\n3.4.1.c Examine the configurations and observe the processes to verify that cardholder data on removable media is encrypted wherever stored. \n\nNote: If disk encryption is not used to encrypt removable media, the data stored on this media will need to be rendered unreadable through some other method.","The intent of this requirement is to address the acceptability of disk-level encryption for rendering cardholder data unreadable. Disk-level encryption encrypts the entire disk/partition on a computer and automatically decrypts the information when an authorized user requests it. Many disk-encryption solutions intercept operating system read/write operations and carry out the appropriate cryptographic C56transformations without any special action by the user other than supplying a password or pass phrase upon system startup or at the beginning of a session. Based on these characteristics of disk-level encryption, to be compliant with this requirement, the method cannot: \n\n1) Use the same user account authenticator as the operating system, or \n2) Use a decryption key that is associated with or derived from the system’s local user account database or general network login credentials. \n\nFull disk encryption helps to protect data in the event of physical loss of a disk and therefore may be appropriate for portable devices that store cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.4.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.5 Document and implement procedures to protect keys used to secure stored cardholder data against disclosure and misuse: \n\nNote: This requirement applies to keys used to encrypt stored cardholder data, and also applies to key-encrypting keys used to protect data-encrypting keys—such key-encrypting keys must be at least as strong as the data-encrypting key. ","3.5 Examine key-management policies and procedures to verify processes are specified to protect keys used for encryption of cardholder data against disclosure and misuse and include at least the following: \n\n. Access to keys is restricted to the fewest number of custodians necessary. \n. Key-encrypting keys are at least as strong as the data-encrypting keys they protect. \n. Key-encrypting keys are stored separately from data-encrypting keys. \n. Keys are stored securely in the fewest possible locations and forms. ","Cryptographic keys must be strongly protected because those who obtain access will be able to decrypt data. Key-encrypting keys, if used, must be at least as strong as the data-encrypting key in order to ensure proper protection of the key that encrypts the data as well as the data encrypted with that key. \n\nThe requirement to protect keys from disclosure and misuse applies to both data-encrypting keys and key-encrypting keys. Because one key-encrypting key may grant access to many data-encrypting keys, the key-encrypting keys require strong protection measures. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.5.1 Restrict access to cryptographic \nkeys to the fewest number of \ncustodians necessary.","3.5.1 Examine user access lists to verify that access to keys is restricted to the fewest number of custodians necessary. ","3.5.1 Examine user access lists to verify that access to keys is restricted to the fewest number of custodians necessary. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.5.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.5.2 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: \n\n. Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data-encrypting key \n. Within a secure cryptographic device (such as a host security module (HSM) or PTS-approved point-of-interaction device) \n. As at least two full-length key components or key shares, in accordance with an industry-accepted method \n\nNote: It is not required that public keys be stored in one of these forms. \n","3.5.2.a Examine documented procedures to verify that cryptographic keys used to encrypt/decrypt cardholder data must only exist in one (or more) of the following forms at all times. \n\n. Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data-encrypting key \n. Within a secure cryptographic device (such as a host security module (HSM) or PTS-approved point-of-interaction device) \n. As key components or key shares, in accordance with anindustry-accepted method \n\n3.5.2.b Examine system configurations and key storage locations to verify that cryptographic keys used to encrypt/decrypt cardholder data exist in one (or more) of the \nfollowing form at all times. \n\n. Encrypted with a key-encrypting key \n. Within a secure cryptographic device (such as a host security module (HSM) or PTS-approved point-of-interaction device) \n. As key components or key shares, in accordance with an industry-accepted method \n\n3.5.2.c Wherever key-encrypting keys are used, examine system configurations and key storage locations to verify: \n. Key-encrypting keys are at least as strong as the data-encrypting keys they protect \n. Key-encrypting keys are stored separately from data-encrypting keys. \n","Cryptographic keys must be stored securely to prevent unauthorized or unnecessary access that could result in the exposure of cardholder data. \n\nIt is not intended that the key-encrypting keys be encrypted, however they are to be protected against disclosure and misuse as defined in Requirement 3.5. If key-encrypting keys are used, storing the key-encrypting keys in physically and/or logically separate locations from the data-encrypting keys reduces the risk of unauthorized access to both keys. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.5.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.5.3 Store cryptographic keys in the \nfewest possible locations. \n","3.5.3 Examine key storage locations and observe processes to verify that keys are stored in the fewest possible locations. ","Storing cryptographic keys in the fewest locations helps an organization to keep track and monitor all key locations, and minimizes the potential for keys to be exposed to unauthorized parties.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.5.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.6 Fully document and implement all key-management processes and procedures for cryptographic keys used for encryption of cardholder data, including the following: \n\nNote: Numerous industry standards for key management are available from various resources including NIST, which can be found at http://csrc.nist.gov. ","3.6.a Additional testing procedure for service providers: If the service provider shares keys with their customers for transmission or storage of cardholder data, examine the documentation that the service provider provides to their customers to verify that it includes guidance on how to securely \ntransmit, store, and update customers’ keys, in accordance with Requirements 3.6.1 through 3.6.8 below.\n\n3.6.b Examine the key-management procedures and processes for keys used for encryption of cardholder data and perform the \nfollowing: ","The manner in which cryptographic keys are managed is a critical part of the continued security of the encryption solution. A good key-management process, whether it is manual or automated as part of the encryption product, is based on industry standards and addresses all key elements at 3.6.1 through 3.6.8. \n\nProviding guidance to customers on how to securely transmit, store and update cryptographic keys can help prevent keys from being mismanaged or disclosed to unauthorized entities. \n\nThis requirement applies to keys used to encrypt stored cardholder data, and any respective key-encrypting keys. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.6.1 Generation of strong cryptographic keys \n","3.6.1.a Verify that key-management procedures specify how to generate strong keys. \n\n3.6.1.b Observe the method for generating keys to verify that strong keys are generated. ","The encryption solution must generate strong keys, as defined in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms under \"strong cryptography.\" Use of strong cryptographic keys significantly increases the level of security of encrypted cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.6.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.6.2 Secure cryptographic key \ndistribution ","3.6.2.a Verify that key-management procedures specify how to securely distribute keys.\n\n3.6.2.b Observe the method for distributing keys to verify that keys are distributed securely.","The encryption solution must distribute keys securely, meaning the keys are distributed only to custodians identified in 3.5.1, and are never distributed in the clear. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.6.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.6.3 Secure cryptographic key storage","3.6.3.a Verify that key-management procedures specify how to securely store keys.\n\n3.6.3.b Observe the method for storing keys to verify that keys are stored securely. ","The encryption solution must store keys securely, for example, by encrypting them with a key-\nencrypting key. Storing keys without proper protection could provide access to attackers, resulting in the decryption and exposure of \ncardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.6.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.6.4 Cryptographic key changes for \nkeys that have reached the end of their \ncryptoperiod (for example, after a \ndefined period of time has passed \nand/or after a certain amount of cipher-\ntext has been produced by a given \nkey), as defined by the associated \napplication vendor or key owner, and \nbased on industry best practices and \nguidelines (for example, NIST Special \nPublication 800-57).","3.6.4.a Verify that key-management procedures include a defined cryptoperiod for each key type in use and define a process for key changes at the end of the defined cryptoperiod(s). \n\n3.6.4.b Interview personnel to verify that keys are changed at the end of the defined cryptoperiod(s). ","A cryptoperiod is the time span during which a particular cryptographic key can be used for its defined purpose. Considerations for defining the \ncryptoperiod include, but are not limited to, the strength of the underlying algorithm, size or length of the key, risk of key compromise, and the sensitivity of the data being encrypted. \n\nPeriodic changing of encryption keys when the keys have reached the end of their cryptoperiod is imperative to minimize the risk of someone’s \nobtaining the encryption keys, and using them to decrypt data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.6.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.6.5 Retirement or replacement (for example, archiving, destruction, and/or revocation) of keys as deemed necessary when the integrity of the key has been weakened (for example, \ndeparture of an employee with knowledge of a clear-text key component), or keys are suspected of being compromised. \n\nNote: If retired or replaced cryptographic keys need to be retained, these keys must be securely archived (for example, by using a key-encryption key). Archived cryptographic keys should only be used for decryption/verification purposes. ","3.6.5.a Verify that key-management procedures specify processes for the following: \n\n. The retirement or replacement of keys when the integrity of the key has been weakened \n. The replacement of known or suspected compromised keys. \n. Any keys retained after retiring or replacing are not used for encryption operations \n\n3.6.5.b Interview personnel to verify the following processes are implemented: \n\n. Keys are retired or replaced as necessary when the integrity of the key has been weakened, including when someone with knowledge of the key leaves the company. \n. Keys are replaced if known or suspected to be compromised. \n. Any keys retained after retiring or replacing are not used for encryption operations. ","Keys that are no longer used or needed, or keys that are known or suspected to be compromised, \nshould be revoked and/or destroyed to ensure that the keys can no longer be used. If such keys need to be kept (for example, to support archived, \nencrypted data) they should be strongly protected. \n\nThe encryption solution should provide for and facilitate a process to replace keys that are due for replacement or that are known to be, or suspected of being, compromised. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.6.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.6.6 If manual clear-text cryptographic key-management operations are used,  these operations must be managed using split knowledge and dual control. \n\nNote: Examples of manual key-management operations include, but are not limited to: key generation, transmission, loading, storage and \ndestruction. ","3.6.6.a Verify that manual clear-text key-management procedures specify processes for the use of the following: \n\n. Split knowledge of keys, such that key components are under the control of at least two people who only have knowledge of their own key components; AND \n. Dual control of keys, such that at least two people are required to perform any key-management operations and no one person has access to the authentication materials (for example, passwords or keys) of another. \n\n3.6.6 b Interview personnel and/or observe processes to verify that manual clear-text keys are managed with: \n\n. Split knowledge, AND \n. Dual control ","Split knowledge and dual control of keys are used to eliminate the possibility of one person having access to the whole key. This control is applicable for manual key-management operations, or where key management is not implemented by the encryption product. \n\nSplit knowledge is a method in which two or more people separately have key components, where each person knows only their own key component, and the individual key components convey no knowledge of the original cryptographic key). \n\nDual control requires two or more people to perform a function, and no single person can access or use the authentication materials of another. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.6.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.6.7 Prevention of unauthorized \nsubstitution of cryptographic keys.","3.6.7.a Verify that key-management procedures specify processes to prevent unauthorized substitution of keys. \n\n3.6.7.b Interview personnel and/or observe processes to verify that unauthorized substitution of keys is prevented. ","The encryption solution should not allow for or accept substitution of keys coming from unauthorized sources or unexpected processes. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.6.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.6.8 Requirement for cryptographic \nkey custodians to formally acknowledge that they understand and accept their key-custodian responsibilities. ","3.6.8.a Verify that key-management procedures specify processes for key custodians to acknowledge (in writing or \nelectronically) that they understand and accept their key-custodian responsibilities. \n\n3.6.8.b Observe documentation or other evidence showing that key custodians have acknowledged (in writing or electronically) that they understand and accept their key-\ncustodian responsibilities. ","This process will help ensure individuals that act as key custodians commit to the key-custodian role and understand and accept the responsibilities. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.6.8","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["3.7 Ensure that security policies and \noperational procedures for protecting \nstored cardholder data are documented, \nin use, and known to all affected parties. ","3.7 Examine documentation interview personnel to verify that security policies and operational procedures for protecting stored cardholder data are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. ","Personnel need to be aware of and following security policies and documented operational procedures for managing the secure storage of cardholder data on a continuous basis. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"3.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"4","index":4,"n_rows":37,"n_cols":6,"rows_kept":37,"cut":false,"hidden":false,"merged":[[16,5,17,5],[17,3,18,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[34,5,35,5],[35,3,36,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["4.1 Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks, including the following: \n\n. Only trusted keys and certificates are accepted. \n. The protocol in use only supports secure versions or configurations. \n. The encryption strength is appropriate for the encryption methodology in use. \n\nExamples of open, public networks include but are not limited to: \n\n. The Internet \n. Wireless technologies, including 802.11 and Bluetooth \n. Cellular technologies, for example, Global System for Mobile communications (GSM), Code \ndivision multiple access (CDMA) \n. General Packet Radio Service (GPRS). \n. Satellite communications. ","4.1.a Identify all locations where cardholder data is transmitted or received over open, public networks. Examine documented standards and compare to system configurations to verify the use of security protocols and strong cryptography for all locations. \n\n4.1.b Review documented policies and procedures to verify processes are specified for the following: \n\n. For acceptance of only trusted keys and/or certificates \n. For the protocol in use to only support secure versions and configurations (that insecure versions or configurations are not supported) \n. For implementation of proper encryption strength per the encryption methodology in use \n\n4.1.c Select and observe a sample of inbound and outbound transmissions as they occur to verify that all cardholder data is encrypted with strong cryptography during transit. \n\n4.1.d Examine keys and certificates to verify that only trusted keys and/or certificates are accepted. \n\n4.1.e Examine system configurations to verify that the protocol is implemented to use only secure configurations and does not support insecure versions or configurations. \n\n4.1.f Examine system configurations to verify that the proper encryption strength is implemented for the encryption methodology in use. (Check vendor recommendations/best practices.) \n\n4.1.g For SSL/TLS implementations, examine system \nconfigurations to verify that SSL/TLS is enabled whenever cardholder data is transmitted or received. \n\nFor example, for browser-based implementations: \n\n. “HTTPS” appears as the browser Universal Record \nLocator (URL) protocol, and \n. Cardholder data is only requested if “HTTPS” appears as part of the URL.","Sensitive information must be encrypted during transmission over public networks, because it is easy and common for a malicious individual to intercept and/or divert data while in transit. \n\nSecure transmission of cardholder data requires using trusted keys/certificates, a secure protocol for transport, and proper encryption strength to encrypt cardholder data. Connection requests from systems that do not support the required \nencryption strength, and that would result in an insecure connection, should not be accepted. \n\nNote that some protocol implementations (such as SSL v2.0, SSH v1.0 and TLS 1.0) have known vulnerabilities that an attacker can use to gain control of the affected system. Whichever security protocol is used, ensure it is configured to use only secure versions and configurations to prevent use of an insecure connection. For example, TLS \nv1.1, or later, certificates obtained from a \nrecognized, public certificate authority and \nsupporting only strong encryption, may be \nconsidered. \n\nVerifying that certificates are trusted (for example, have not expired and are issued from a trusted source) helps ensure the integrity of the secure connection. \n\nGenerally, the web page URL should begin with \"HTTPS\" and/or the web browser display a padlock icon somewhere in the window of the browser. Many SSL certificate vendors also provide a highly visible verification seal— sometimes referred to as a “security seal,” \"secure site seal,\" or “secure trust seal”)—which may provide the ability to click on the seal to reveal information about the website. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"4.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["4.1.1 Ensure wireless networks transmitting cardholder data or connected to the cardholder data environment, use industry best practices (for example, IEEE 802.11i) to implement strong encryption for authentication and transmission. \n\nNote: The use of WEP as a security control is prohibited. ","4.1.1 Identify all wireless networks transmitting cardholder data or connected to the cardholder data environment. Examine documented standards and compare to system configuration settings to verify the following for all wireless networks identified: \n\n. Industry best practices (for example, IEEE 802.11i) are used to implement strong encryption for authentication and transmission. \n. Weak encryption (for example, WEP, SSL version 2.0 or older) is not used as a security control for authentication or transmission. ","Malicious users use free and widely available \ntools to eavesdrop on wireless communications. \nUse of strong cryptography can help limit disclosure of sensitive information across wireless networks. \n\nStrong cryptography for authentication and transmission of cardholder data is required to prevent malicious users from gaining access to the wireless network or utilizing wireless networks to access other internal networks or data",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"4.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["4.2 Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat, etc.). ","4.2.a If end-user messaging technologies are used to send cardholder data, observe processes for sending PAN and examine a sample of outbound transmissions as they occur to verify that PAN is rendered unreadable or secured with strong cryptography whenever it is sent via end-user messaging \ntechnologies. \n\n4.2.b Review written policies to verify the existence of a policy stating that unprotected PANs are not to be sent via end-user messaging technologies. ","E-mail, instant messaging, and chat can be easily \nintercepted by packet-sniffing during delivery \nacross internal and public networks. Do not utilize \nthese messaging tools to send PAN unless they \nare configured to provide strong encryption. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"4.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["4.3 Ensure that security policies and operational procedures for encrypting transmissions of cardholder data are documented, in use, and known to all affected parties. \n","4.3 Examine documentation interview personnel to verify that security policies and operational procedures for encrypting transmissions of cardholder data are: \n\n. Documented, \n. In use, and \n. Known to all affected parties.","Personnel need to be aware of and following security policies and operational procedures for managing the secure transmission of cardholder data on a continuous basis",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"4.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"5","index":5,"n_rows":55,"n_cols":6,"rows_kept":55,"cut":false,"hidden":false,"merged":[[16,5,17,5],[17,3,18,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[34,5,35,5],[35,3,36,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[52,5,53,5],[53,3,54,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). \n","5.1 For a sample of system components including all operating system types commonly affected by malicious software, verify that anti-virus software is deployed if applicable anti-virus technology exists. ","There is a constant stream of attacks using widely published exploits, often called \"zero day\" (an attack that exploits a previously unknown vulnerability), against otherwise secured systems. Without an anti-virus solution that is updated \nregularly, these new forms of malicious software can attack systems, disable a network, or lead to compromise of data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"5.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["5.1.1 Ensure that anti-virus programs are capable of detecting, removing, and protecting against all known types of malicious software. ","5.1.1 Review vendor documentation and examine anti-virus configurations to verify that anti-virus programs; \n\n. Detect all known types of malicious software, \n. Remove all known types of malicious software, and \n. Protect against all known types of malicious software. ","Examples of types of malicious software include viruses, Trojans, worms, spyware, adware, and rootkits. \n\nIt is important to protect against ALL types and forms of malicious software. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"5.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["5.1.2 For systems considered to be not \ncommonly affected by malicious software, perform periodic evaluations to identify and evaluate evolving malware threats in order to confirm whether such systems continue to not \nrequire anti-virus software.","5.1.2 Interview personnel to verify that evolving malware threats are monitored and evaluated for systems not currently \nconsidered to be commonly affected by malicious software, in order to confirm whether such systems continue to not require \nanti-virus software. ","Typically, mainframes, mid-range computers (such as AS/400) and similar systems may not currently be commonly targeted or affected by malware. However, industry trends for malicious software can change quickly, so it is important for organizations to be aware of new malware that might affect their systems—for example, by monitoring vendor security notices and anti-virus news groups to determine whether their systems might be coming under threat from new and evolving malware. \n\nTrends in malicious software should be included in the identification of new security vulnerabilities, and methods to address new trends should be \nincorporated into the company's configuration standards and protection mechanisms as needed ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"5.1.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["5.2 Ensure that all anti-virus mechanisms \nare maintained as follows: \n\n. Are kept current, \n. Perform periodic scans \n. Generate audit logs which are \nretained per PCI DSS Requirement \n10.7. ","5.2.a Examine policies and procedures to verify that anti-virus software and definitions are required to be kept up to date. \n\n5.2.b Examine anti-virus configurations, including the master installation of the software to verify anti-virus mechanisms are: \n\n. Configured to perform automatic updates, and \n. Configured to perform periodic scans. \n\n5.2.c Examine a sample of system components, including all operating system types commonly affected by malicious \nsoftware, to verify that: \n\n. The anti-virus software and definitions are current. \n. Periodic scans are performed. \n\n5.2.d Examine anti-virus configurations, including the master installation of the software and a sample of system components, to verify that: \n\n. Anti-virus software log generation is enabled, and \n. Logs are retained in accordance with PCI DSS Requirement 10.7.","Even the best anti-virus solutions are limited in effectiveness if they are not maintained and kept current with the latest security updates, signature \nfiles, or malware protections. \n\nAudit logs provide the ability to monitor virus and malware activity and anti-malware reactions. Thus, it is imperative that anti-malware solutions \nbe configured to generate audit logs and that these logs be managed in accordance with Requirement 10. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"5.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["5.3 Ensure that anti-virus mechanisms are actively running and cannot be disabled or altered by users, unless specifically authorized by management on a case-by-case basis for a limited time period. \n\nNote: Anti-virus solutions may be temporarily disabled only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must \nbe formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active. ","5.3.a Examine anti-virus configurations, including the master installation of the software and a sample of system components, to verify the anti-virus software is actively running. \n\n5.3.b Examine anti-virus configurations, including the master installation of the software and a sample of system components, to verify that the anti-virus software cannot be \ndisabled or altered by users. \n\n5.3.c Interview responsible personnel and observe processes to verify that anti-virus software cannot be disabled or altered by \nusers, unless specifically authorized by management on a case-by-case basis for a limited time period. ","Anti-virus that continually runs and is unable to be altered will provide persistent security against malware. \n\nUse of policy-based controls on all systems to ensure anti-malware protections cannot be altered \nor disabled will help prevent system weaknesses from being exploited by malicious software. \n\nAdditional security measures may also need to be implemented for the period of time during which anti-virus protection is not active—for example, \ndisconnecting the unprotected system from the Internet while the anti-virus protection is disabled, and running a full scan after it is re-enabled.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"5.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["5.4 Ensure that security policies and operational procedures for protecting systems against malware are documented, in use, and known to all affected parties. ","5.4 Examine documentation and interview personnel to verify that security policies and operational procedures for protecting \nsystems against malware are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. \n","Personnel need to be aware of and following security policies and operational procedures to ensure systems are protected from malware on a continuous basis. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"5.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"6","index":6,"n_rows":253,"n_cols":6,"rows_kept":253,"cut":false,"hidden":false,"merged":[[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[16,5,17,5],[17,3,18,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[34,5,35,5],[35,3,36,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4],[52,5,53,5],[53,3,54,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[64,0,72,0],[64,1,72,1],[64,2,72,2],[64,4,66,4],[70,4,71,4],[70,5,71,5],[71,3,72,3],[55,0,63,0],[55,1,63,1],[55,2,63,2],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[82,0,90,0],[82,1,90,1],[82,2,90,2],[82,4,84,4],[88,4,89,4],[88,5,89,5],[89,3,90,3],[73,0,81,0],[73,1,81,1],[73,2,81,2],[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[100,0,108,0],[100,1,108,1],[100,2,108,2],[100,4,102,4],[106,4,107,4],[106,5,107,5],[107,3,108,3],[91,0,99,0],[91,1,99,1],[91,2,99,2],[91,4,93,4],[97,4,98,4],[97,5,98,5],[98,3,99,3],[118,0,126,0],[118,1,126,1],[118,2,126,2],[118,4,120,4],[124,4,125,4],[124,5,125,5],[125,3,126,3],[109,0,117,0],[109,1,117,1],[109,2,117,2],[109,4,111,4],[115,4,116,4],[115,5,116,5],[116,3,117,3],[136,0,144,0],[136,1,144,1],[136,2,144,2],[136,4,138,4],[142,4,143,4],[142,5,143,5],[143,3,144,3],[127,0,135,0],[127,1,135,1],[127,2,135,2],[127,4,129,4],[133,4,134,4],[133,5,134,5],[134,3,135,3],[154,0,162,0],[154,1,162,1],[154,2,162,2],[154,4,156,4],[160,4,161,4],[160,5,161,5],[161,3,162,3],[145,0,153,0],[145,1,153,1],[145,2,153,2],[145,4,147,4],[151,4,152,4],[151,5,152,5],[152,3,153,3],[172,0,180,0],[172,1,180,1],[172,2,180,2],[172,4,174,4],[178,4,179,4],[178,5,179,5],[179,3,180,3],[163,0,171,0],[163,1,171,1],[163,2,171,2],[163,4,165,4],[169,4,170,4],[169,5,170,5],[170,3,171,3],[190,0,198,0],[190,1,198,1],[190,2,198,2],[190,4,192,4],[196,4,197,4],[196,5,197,5],[197,3,198,3],[181,0,189,0],[181,1,189,1],[181,2,189,2],[181,4,183,4],[187,4,188,4],[187,5,188,5],[188,3,189,3],[208,0,216,0],[208,1,216,1],[208,2,216,2],[208,4,210,4],[214,4,215,4],[214,5,215,5],[215,3,216,3],[199,0,207,0],[199,1,207,1],[199,2,207,2],[199,4,201,4],[205,4,206,4],[205,5,206,5],[206,3,207,3],[226,0,234,0],[226,1,234,1],[226,2,234,2],[226,4,228,4],[232,4,233,4],[232,5,233,5],[233,3,234,3],[217,0,225,0],[217,1,225,1],[217,2,225,2],[217,4,219,4],[223,4,224,4],[223,5,224,5],[224,3,225,3],[244,0,252,0],[244,1,252,1],[244,2,252,2],[244,4,246,4],[250,4,251,4],[250,5,251,5],[251,3,252,3],[235,0,243,0],[235,1,243,1],[235,2,243,2],[235,4,237,4],[241,4,242,4],[241,5,242,5],[242,3,243,3]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["6.1 Establish a process to identify security \nvulnerabilities, using reputable outside \nsources for security vulnerability information, and assign a risk ranking (for example, as “high,” “medium,” or “low”) to newly discovered security vulnerabilities. \n\nNote: Risk rankings should be based on \nindustry best practices as well as consideration of potential impact. For example, criteria for ranking vulnerabilities may include consideration of the CVSS base score, and/or the classification by the vendor, and/or type of systems affected. \n\nMethods for evaluating vulnerabilities and \nassigning risk ratings will vary based on an \norganization’s environment and risk-\nassessment strategy. Risk rankings should, \nat a minimum, identify all vulnerabilities \nconsidered to be a “high risk” to the environment. In addition to the risk ranking, vulnerabilities may be considered “critical” if they pose an imminent threat to theenvironment, impact critical systems, and/or would result in a potential compromise if not addressed. Examples of critical systems may include security systems, public-facing devices and systems, databases, and other systems that store, process, or transmit cardholder data. ","6.1.a Examine policies and procedures to verify that processes are defined for the following: \n\n. To identify new security vulnerabilities \n. To assign a risk ranking to vulnerabilities that includes identification of all “high risk” and “critical” vulnerabilities. \n. To use reputable outside sources for security \nvulnerability information. \n\n6.1.b Interview responsible personnel and observe processes to verify that: \n\n. New security vulnerabilities are identified. \n. A risk ranking is assigned to vulnerabilities that includes identification of all “high” risk and “critical” vulnerabilities. \n. Processes to identify new security vulnerabilities include using reputable outside sources for security vulnerability information. ","The intent of this requirement is that organizations keep up to date with new vulnerabilities that may impact their environment. \n\nSources for vulnerability information should be trustworthy and often include vendor websites, industry news groups, mailing list, or RSS feeds. \n\nOnce an organization identifies a vulnerability that could affect their environment, the risk that the \nvulnerability poses must be evaluated and ranked. The organization must therefore have a method in place to evaluate vulnerabilities on an ongoing basis and assign risk rankings to those vulnerabilities. \nThis is not achieved by an ASV scan or internal vulnerability scan, rather this requires a process to actively monitor industry sources for vulnerability \ninformation. \n\nClassifying the risks (for example, as “high,” “medium,” or “low”) allows organizations to identify, prioritize, and address the highest risk items more quickly and reduce the likelihood that vulnerabilities posing the greatest risk will be exploited. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.2 Ensure that all system components and \nsoftware are protected from known \nvulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release. \n\nNote: Critical security patches should be \nidentified according to the risk ranking \nprocess defined in Requirement 6.1. ","6.2.a Examine policies and procedures related to security-patch installation to verify processes are defined for: \n\n. Installation of applicable critical vendor-supplied security patches within one month of release. \n. Installation of all applicable vendor-supplied security patches within an appropriate time frame (for example, within three months). \n\n6.2.b For a sample of system components and related software, compare the list of security patches installed on each system to the most recent vendor security-patch list, to verify the following: \n\n. That applicable critical vendor-supplied security patches are installed within one month of release. \n. All applicable vendor-supplied security patches are \ninstalled within an appropriate time frame (for example, within three months).","There is a constant stream of attacks using widely published exploits, often called \"zero day\" (an attack that exploits a previously unknown vulnerability), against otherwise secured systems. If the most recent patches are not implemented on critical systems as soon as possible, a malicious individual can use these exploits to attack or disable a system, or gain access to sensitive data. \n\nPrioritizing patches for critical infrastructure ensures that high-priority systems and devices are protected from vulnerabilities as soon as possible after a patch is released. Consider prioritizing patch installations such that security patches for critical or at-risk systems are installed within 30 days, and other lower-risk patches are installed within 2-3 months. \n\nThis requirement applies to applicable patches for all installed software.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.3 Develop internal and external software \napplications (including web-based administrative access to applications) \nsecurely, as follows: \n\n. In accordance with PCI DSS (for example, secure authentication and logging) \n. Based on industry standards and/or best \npractices. \n. Incorporating information security throughout the software-development life cycle \n\nNote: this applies to all software developed \ninternally as well as bespoke or custom \nsoftware developed by a third party. ","6.3.a Examine written software-development processes to verify that the processes are based on industry standards and/or best practices. \n\n6.3.b Examine written software-development processes to verify that information security is included throughout the life cycle. \n\n6.3.c Examine written software-development processes to verify that software applications are developed in accordance with PCI DSS. \n\n6.3.d Interview software developers to verify that written software-development processes are implemented. ","Without the inclusion of security during the \nrequirements definition, design, analysis, and testing phases of software development, security vulnerabilities can be inadvertently or maliciously introduced into the production environment. \n\nUnderstanding how sensitive data is handled by the application—including when stored, transmitted, and when in memory—can help identify where data \nneeds to be protected.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.3.1 Remove development, test and/or \ncustom application accounts, user IDs, and passwords before applications become active or are released to customers. ","6.3.1 Examine written software-development procedures and interview responsible personnel to verify that pre-production and/or custom application accounts, user IDs and/or passwords are removed before an application goes into production or is released to customers","Development, test and/or custom application accounts, user IDs, and passwords should be removed from production code before the application becomes active or is released to customers, since these items may give away\ninformation about the functioning of the application.  Possession of such information could facilitate compromise of the application and related cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.3.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.3.2 Review custom code prior to release \nto production or customers in order to \nidentify any potential coding vulnerability \n(using either manual or automated processes) to include at least the following: \n\n. Code changes are reviewed by individuals other than the originating code author, and by individuals knowledgeable about code-review \ntechniques and secure coding practices. \n. Code reviews ensure code is developed according to secure coding guidelines \n. Appropriate corrections are implemented prior to release. \n. Code-review results are reviewed and \napproved by management prior to release. \n\nNote: This requirement for code reviews \napplies to all custom code (both internal and public-facing), as part of the system \ndevelopment life cycle. \n\nCode reviews can be conducted by \nknowledgeable internal personnel or third parties. Public-facing web applications are also subject to additional controls, to address \nongoing threats and vulnerabilities after \nimplementation, as defined at PCI DSS \nRequirement 6.6.","6.3.2.a Examine written software-development procedures and interview responsible personnel to verify that all custom application code changes must be reviewed (using either manual or automated processes) as follows: \n\n. Code changes are reviewed by individuals other than the originating code author, and by individuals who are knowledgeable in code-review techniques and secure coding practices. \n. Code reviews ensure code is developed according to secure coding guidelines (see PCI DSS Requirement 6.5). \n. Appropriate corrections are implemented prior to \nrelease. \n. Code-review results are reviewed and approved by \nmanagement prior to release. \n\n6.3.2.b Select a sample of recent custom application \nchanges and verify that custom application code is \nreviewed according to 6.3.2.a, above.","Security vulnerabilities in custom code are commonly exploited by malicious individuals to gain access to a network and compromise cardholder data. \n\nAn individual knowledgeable and experienced in code-review techniques should be involved in the review process. Code reviews should be performed by someone other than the developer of the code to allow for an independent, objective review. Automated tools or processes may also be used in lieu of manual reviews, but keep in mind that it may be difficult or even impossible for an automated tool to identify some coding issues. \n\nCorrecting coding errors before the code is deployed into a production environment or released to customers prevents the code exposing the environments to potential exploit. Faulty code is also far more difficult and expensive to address after it has been deployed or released into production environments. \n\nIncluding a formal review and signoff by management prior to release helps to ensure that code is approved and has been developed in accordance with policies and procedures. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.3.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4 Follow change control processes and \nprocedures for all changes to system components. The processes must include the following: ","6.4 Examine policies and procedures to verify the following are defined: \n\n. Development/test environments are separate from production environments with access control in place to enforce separation. \n. A separation of duties between personnel assigned to the development/test environments and those assigned to the production environment. \n. Production data (live PANs) are not used for testing or development. \n. Test data and accounts are removed before a production system becomes active. \n. Change control procedures related to implementing security patches and software modifications are documented. ","Without properly documented and implemented change controls, security features could be inadvertently or deliberately omitted or rendered inoperable, processing irregularities could occur, or malicious code could be introduced.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4.1 Separate development/test environments from production environments, and enforce the separation with access controls. \n","6.4.1.a Examine network documentation and network device configurations to verify that the development/test environments are separate from the production environment(s). \n\n6.4.1.b Examine access controls settings to verify that access controls are in place to enforce separation between the development/test environments and the production environment(s). ","Due to the constantly changing state of development and test environments, they tend to be less secure than the production environment. Without adequate separation between environments, it may be possible for the production environment, and cardholder data, to be compromised due to less-stringent security configurations and possible vulnerabilities in a test or development environment. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4.2 Separation of duties between development/test and production\nenvironments","6.4.2 Observe processes and interview personnel assigned to development/test environments and personnel assigned to production environments to verify that separation of duties is in place between development/test environments and the production environment. \n","Reducing the number of personnel with access to the production environment and cardholder data minimizes risk and helps ensure that access is limited to those individuals with a business need to \nknow. \n\nThe intent of this requirement is to separate development and test functions from production functions. For example, a developer may use an administrator-level account with elevated privileges in the development environment, and have a \nseparate account with user-level access to the production environment. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4.3 Production data (live PANs) are not \nused for testing or development ","6.4.3.a Observe testing processes and interview personnel to verify procedures are in place to ensure production data (live PANs) are not used for testing or development.\n\n6.4.3.b Examine a sample of test data to verify production data (live PANs) is not used for testing or development. ","Security controls are usually not as stringent in test or development environments. Use of production data provides malicious individuals with the opportunity to gain unauthorized access to production data (cardholder data). ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4.4 Removal of test data and accounts \nbefore production systems become active ","6.4.4.a Observe testing processes and interview personnel to verify test data and accounts are removed before a production system becomes active. \n\n6.4.4.b Examine a sample of data and accounts from production systems recently installed or updated to verify test data and accounts are removed before the system becomes active. ","Test data and accounts should be removed from production code before the application becomes active, since these items may give away information about the functioning of the application or system. Possession of such information could facilitate compromise of the system and related cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4.5 Change control procedures for the \nimplementation of security patches and \nsoftware modifications must include the \nfollowing: ","6.4.5.a Examine documented change control procedures related to implementing security patches and software modifications and verify procedures are defined for: \n\n. Documentation of impact \n. Documented change approval by authorized parties \n. Functionality testing to verify that the change does not adversely impact the security of the system \n. Back-out procedures \n\n6.4.5.b For a sample of system components, interview responsible personnel to determine recent changes/security patches. Trace those changes back to related change control documentation. For each change examined, perform the following: ","If not properly managed, the impact of software updates and security patches might not be fully realized and could have unintended consequences.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4.5.1 Documentation of impact. ","6.4.5.1 Verify that documentation of impact is included in the change control documentation for each sampled change. \n","The impact of the change should be documented so that all affected parties can plan appropriately for any processing changes. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4.5.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4.5.2 Documented change approval by \nauthorized parties. ","6.4.5.2 Verify that documented approval by authorized parties is present for each sampled change. ","Approval by authorized parties indicates that the change is a legitimate and approved change sanctioned by the organization. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4.5.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4.5.3 Functionality testing to verify that \nthe change does not adversely impact the security of the system.","6.4.5.3.a For each sampled change, verify that \nfunctionality testing is performed to verify that the change does not adversely impact the security of the system. \n\n6.4.5.3.b For custom code changes, verify that all updates are tested for compliance with PCI DSS Requirement 6.5 before being deployed into production. ","Thorough testing should be performed to verify that the security of the environment is not reduced by implementing a change. Testing should validate that all existing security controls remain in place, are \nreplaced with equally strong controls, or are strengthened after any change to the environment.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4.5.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.4.5.4 Back-out procedures. ","6.4.5.4 Verify that back-out procedures are prepared for each sampled change. ","For each change, there should be documented back-out procedures in case the change fails or adversely affects the security of an application or system, to allow the system to be restored back to \nits previous state. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.4.5.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5 Address common coding vulnerabilities in software-development processes as follows: \n\n. Train developers in secure coding techniques, including how to avoid common coding vulnerabilities, and understanding how sensitive data is handled in memory. \n. Develop applications based on secure \ncoding guidelines. \n\nNote: The vulnerabilities listed at 6.5.1 through 6.5.10 were current with industry best practices when this version of PCI DSS was published. However, as industry best practices for vulnerability management are updated (for example, the OWASP Guide, SANS CWE Top 25, CERT Secure Coding, etc.), the current best practices must be used for these requirements. ","6.5.a Examine software-development policies and procedures to verify that training in secure coding techniques is required for developers, based on industry best practices and guidance.\n\n6.5.b Interview a sample of developers to verify that they are knowledgeable in secure coding techniques. \n\n6.5.c Examine records of training to verify that software developers received training on secure coding techniques, including how to avoid common coding vulnerabilities, and understanding how sensitive data is handled in memory. \n\n6.5.d. Verify that processes are in place to protect applications from, at a minimum, the following vulnerabilities: \n\nNote: Requirements 6.5.1 through 6.5.6, below, apply to all applications (internal or external). ","The application layer is high-risk and may be targeted by both internal and external threats. \n\nRequirements 6.5.1 through 6.5.10 are the minimum controls that should be in place, and organizations should incorporate the relevant secure coding practices as applicable to the particular technology in their environment. \n\nApplication developers should be properly trained to identify and resolve issues related to these (and other) common coding vulnerabilities. Having staff knowledgeable of secure coding guidelines should minimize the number of security vulnerabilities introduced through poor coding practices. Training for developers may be provided in-house or by third \nparties and should be applicable for technology used. \n\nAs industry-accepted secure coding practices change, organizational coding practices and developer training should likewise be updated to address new threats—for example, memory scraping attacks. \n\nThe vulnerabilities identified in 6.5.1 through 6.5.10 provide a minimum baseline. It is up to the organization to remain up to date with vulnerability trends and incorporate appropriate measures into their secure coding practices.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.1 Injection flaws, particularly SQL \ninjection. Also consider OS Command \nInjection, LDAP and XPath injection flaws \nas well as other injection flaws. ","6.5.1 Examine software-development policies and procedures and interview responsible personnel to verify that injection flaws are addressed by coding techniques that include: \n\n. Validating input to verify user data cannot modify \nmeaning of commands and queries. \n. Utilizing parameterized queries. \n","Injection flaws, particularly SQL injection, are a commonly used method for compromising applications. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing unintended commands or changing data, and allows the attacker to attack components inside the network through the application, to initiate attacks such as buffer overflows, or to reveal both confidential information \nand server application functionality. \n\nInformation should be validated before being sent to the application—for example, by checking for all alpha characters, mix of alpha and numeric characters, etc. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.2 Buffer overflows","6.5.2 Examine software-development policies and procedures and interview responsible personnel to verify that buffer overflows are addressed by coding techniques that include: \n\n. Validating buffer boundaries. \n. Truncating input strings. ","Buffer overflows occur when an application does not have appropriate bounds checking on its buffer space. This can cause the information in the buffer to be pushed out of the buffer’s memory space and into executable memory space. When this occurs, the attacker has the ability to insert malicious code at the end of the buffer and then push that malicious code into executable memory space by overflowing the buffer. The malicious code is then executed and often enables the attacker remote access to the application and/or infected system.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.3 Insecure cryptographic storage","6.5.3 Examine software-development policies and procedures and interview responsible personnel to verify that insecure cryptographic storage is addressed by coding techniques that: \n\n. Prevent cryptographic flaws. \n. Use strong cryptographic algorithms and keys. ","Applications that do not utilize strong cryptographic functions properly to store data are at increased risk of being compromised, and exposing authentication credentials and/or cardholder data. If an attacker is able to exploit weak cryptographic processes, they may be able to gain clear-text access to encrypted data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.4 Insecure communications","6.5.4 Examine software-development policies and procedures and interview responsible personnel to verify that insecure communications are addressed by coding techniques that properly authenticate and encrypt all sensitive communications.","Applications that fail to adequately encrypt network traffic using strong cryptography are at increased risk of being compromised and exposing cardholder data. If an attacker is able to exploit weak cryptographic processes, they may be able to gain control of an application or even gain clear-text access to encrypted data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.5 Improper error handling ","6.5.5 Examine software-development policies and procedures and interview responsible personnel to verify that improper error handling is addressed by coding techniques that do not leak information via error messages (for example, by returning generic rather than specific error details. ","6.5.5 Examine software-development policies and procedures and interview responsible personnel to verify that improper error handling is addressed by coding techniques that do not leak information via error messages (for example, by returning generic rather than specific error details. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.6 All “high risk” vulnerabilities identified in the vulnerability identification process (as defined in PCI DSS Requirement 6.1).","6.5.6 Examine software-development policies and procedures and interview responsible personnel to verify that coding techniques address any “high risk” vulnerabilities that could affect the application, as identified in PCI DSS Requirement 6.1.\n\nNote: Requirements 6.5.7 through 6.5.10, below, apply to web applications and application interfaces (internal or external):","All vulnerabilities identified by an organization’s vulnerability risk-ranking process (defined in Requirement 6.1) to be “high risk” and that could affect the application should be identified and addressed during application development. \n\n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.7 Cross-site scripting (XSS)","6.5.7 Examine software-development policies and procedures and interview responsible personnel to verify that cross-site scripting (XSS) is addressed by coding techniques that include \n\n. Validating all parameters before inclusion \n. Utilizing context-sensitive escaping. ","XSS flaws occur whenever an application takes user-supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser, which can hijack user sessions, deface web sites, possibly introduce worms, etc. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.8 Improper access control (such as \ninsecure direct object references, failure to restrict URL access, directory traversal, and failure to restrict user access to functions). ","6.5.8 Examine software-development policies and procedures and interview responsible personnel to verify that improper access control—such as insecure direct object references, failure to restrict URL access, and directory traversal—is addressed by coding technique that includes: \n\n. Proper authentication of users \n. Sanitizing input \n. Not exposing internal object references to users \n. User interfaces that do not permit access to \nunauthorized functions. ","A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter. Attackers can manipulate those references to access other objects without authorization. \n\nConsistently enforce access control in presentation layer and business logic for all URLs. Frequently, the only way an application protects sensitive functionality is by preventing the display of links or URLs to unauthorized users. Attackers can use this weakness to access and perform unauthorized operations by accessing those URLs directly. \n\nAn attacker may be able to enumerate and navigate the directory structure of a website (directory traversal) thus gaining access to unauthorized information as well as gaining further insight into the workings of the site for later exploitation. \n\nIf user interfaces permit access to unauthorized functions, this access could result in unauthorized individuals gaining access to privileged credentials or cardholder data. Only authorized users should be permitted to access direct object references to sensitive resources. Limiting access to data resources will help prevent cardholder data from being presented to unauthorized resources. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.8","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D211,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D211,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.9 Cross-site request forgery (CSRF) ","6.5.9 Examine software development policies and procedures and interview responsible personnel to verify that cross-site request forgery (CSRF) is addressed by coding techniques that ensure applications do not rely on authorization credentials and tokens automatically submitted by browsers. ","A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request to a vulnerable web application, which then enables the attacker to perform any state-changing operations the victim is authorized to perform (such as updating account details, making purchases, or even authenticating to the application). \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.9","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D220,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D220,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.5.10 Broken authentication and session \nmanagement \n\nNote: Requirement 6.5.10 is a best practice until June 30, 2015, after which it becomes a requirement.","6.5.10 Examine software development policies and procedures and interview responsible personnel to verify that broken authentication and session management are addressed via coding techniques that commonly include: \n\n. Flagging session tokens (for example cookies) as “secure” \n. Not exposing session IDs in the URL \n. Incorporating appropriate time-outs and rotation of session IDs after a successful login. \n","Secure authentication and session management prevents unauthorized individuals from compromising legitimate account credentials, keys, or session tokens that would otherwise enable the intruder to assume the identity of an authorized \nuser.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.5.10","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D229,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D229,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.6 For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by either of the following methods: \n\n. Reviewing public-facing web applications \nvia manual or automated application vulnerability security assessment tools or methods, at least annually and after any changes \n\nNote: This assessment is not the same as the vulnerability scans performed for Requirement 11.2. \n\n. Installing an automated technical solution that detects and prevents web-based attacks (for example, a web-application firewall) in front of public-facing web applications, to continually check all traffic. \n","6.6 For public-facing web applications, ensure that either one of the following methods is in place as follows: \n\n. Examine documented processes, interview personnel, and examine records of application security assessments to verify that public-facing web applications are reviewed—using either manual or automated vulnerability security assessment tools or methods—as follows: \n- At least annually \n- After any changes \n- By an organization that specializes in application security \n- That, at a minimum, all vulnerabilities in \nRequirement 6.5 are included in the assessment \n- That all vulnerabilities are corrected \n- That the application is re-evaluated after the \ncorrections. \n. Examine the system configuration settings and interview responsible personnel to verify that an automated technical solution that detects and prevents web-based attacks (for example, a web-application firewall) is in place as follows: \n- Is situated in front of public-facing web applications to detect and prevent web-based attacks. \n- Is actively running and up to date as applicable. \n- Is generating audit logs. \n- Is configured to either block web-based attacks, or generate an alert. ","Public-facing web applications are primary targets for attackers, and poorly coded web applications provide an easy path for attackers to gain access to sensitive data and systems. The requirement for \nreviewing applications or installing web-application firewalls is intended to reduce the number of compromises on public-facing web applications due to poor coding or application management practices. \n\n. Manual or automated vulnerability security assessment tools or methods review and/or test the application for vulnerabilities \n. Web-application firewalls filter and block non-essential traffic at the application layer. Used in conjunction with a network-based firewall, a properly configured web-application firewall prevents application-layer attacks if applications are improperly coded or configured. \n\nNote: “An organization that specializes in application security” can be either a third-party company or an internal organization, as long as the reviewers specialize in application security and can demonstrate independence from the development team.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D238,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D238,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["6.7 Ensure that security policies and operational procedures for developing and \nmaintaining secure systems and applications are documented, in use, and known to all affected parties.","6.7 Examine documentation and interview personnel to verify that security policies and operational procedures for developing and maintaining secure systems and applications are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. ","Personnel need to be aware of and following security policies and operational procedures to ensure systems and applications are securely developed and protected from vulnerabilities on a continuous basis. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"6.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D247,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D247,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"7","index":7,"n_rows":91,"n_cols":6,"rows_kept":91,"cut":false,"hidden":false,"merged":[[16,5,17,5],[17,3,18,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[34,5,35,5],[35,3,36,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[52,5,53,5],[53,3,54,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4],[70,5,71,5],[71,3,72,3],[55,0,63,0],[55,1,63,1],[55,2,63,2],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[64,0,72,0],[64,1,72,1],[64,2,72,2],[64,4,66,4],[70,4,71,4],[88,5,89,5],[89,3,90,3],[73,0,81,0],[73,1,81,1],[73,2,81,2],[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[82,0,90,0],[82,1,90,1],[82,2,90,2],[82,4,84,4],[88,4,89,4]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["7.1 Limit access to system components and cardholder data to only those individuals whose job requires such access.","7.1 Examine written policy for access control, and verify that the policy incorporates 7.1.1 through 7.1.4 as follows: \n\n. Defining access needs and privilege assignments for each role \n. Restriction of access to privileged user IDs to least privileges necessary to perform job responsibilities \n. Assignment of access based on individual personnel’s job classification and function \n. Documented approval (electronically or in writing) by authorized parties for all access, including listing of specific privileges approved. ","The more people who have access to cardholder data, the more risk there is that a user’s account will be used maliciously. Limiting access to those with a legitimate business reason for the access helps an \norganization prevent mishandling of cardholder data through inexperience or malice. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["7.1.1 Define access needs for each role, including: \n\n. System components and data resources that each role needs to access for their job function \n. Level of privilege required (for example, user, administrator, etc.) for accessing resources. ","7.1.1 Select a sample of roles and verify access needs for each role are defined and include: \n\n. System components and data resources that each role needs to access for their job function \n. Identification of privilege necessary for each role to perform their job function. ","In order to limit access to cardholder data to only those individuals who need such access, first it is necessary to define access needs for each role (for example, system administrator, call center personnel, store clerk), the systems/devices/data each role needs access to, and the level of privilege each role needs to effectively perform assigned tasks. Once roles and corresponding access needs are defined, individuals can be granted access accordingly. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["7.1.2 Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities. ","7.1.2.a Interview personnel responsible for assigning access to verify that access to privileged user IDs is: \n\n. Assigned only to roles that specifically require such \nprivileged access \n. Restricted to least privileges necessary to perform job responsibilities. \n\n7.1.2.b Select a sample of user IDs with privileged access and interview responsible management personnel to verify that privileges assigned are: \n\n. Necessary for that individual’s job function \n. Restricted to least privileges necessary to perform job responsibilities.","When assigning privileged IDs, it is important to assign individuals only the privileges they need to perform their job (the “least privileges”). For example, the database administrator or backup administrator should not be assigned the same privileges as the overall systems administrator.\n\nAssigning least privileges helps prevent users without sufficient knowledge about the application from incorrectly or accidentally changing application \nconfiguration or altering its security settings. Enforcing least privilege also helps to minimize the scope of damage if an unauthorized person gains access to a user ID. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.1.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["7.1.3 Assign access based on individual personnel’s job classification and function.","7.1.3 Select a sample of user IDs and interview responsible management personnel to verify that privileges assigned are based on that individual’s job classification and function. ","Once needs are defined for user roles (per PCI DSS requirement 7.1.1), it is easy to grant individuals access according to their job classification and function by using the already-created roles. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.1.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["7.1.4 Require documented approval by authorized parties specifying required privileges. ","7.1.4 Select a sample of user IDs and compare with documented approvals to verify that: \n\n. Documented approval exists for the assigned privileges \n. The approval was by authorized parties \n. That specified privileges match the roles assigned to the individual. ","Documented approval (for example, in writing or electronically) assures that those with access and privileges are known and authorized by management, and that their access is necessary for their job function. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.1.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["7.2 Establish an access control system for systems components that restricts access based on a user’s need to know, and is set to “deny all” unless specifically allowed. \n\nThis access control system must include the following: ","7.2 Examine system settings and vendor documentation to verify that an access control system is implemented as follows: ","Without a mechanism to restrict access based on user’s need to know, a user may unknowingly be granted access to cardholder data. An access control system automates the process of restricting access and assigning privileges. Additionally, a default “deny-all” setting ensures no one is granted access until and unless a rule is established specifically granting such access. \n\nNote: Some access control systems are set by default to “allow-all,” thereby permitting access unless/until a rule is written to specifically deny it.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["7.2.1 Coverage of all system components ","7.2.1 Confirm that access control systems are in place on all system components. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.2.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["7.2.2 Assignment of privileges to individuals based on job classification and function. \n","7.2.2 Confirm that access control systems are configured to enforce privileges assigned to individuals based on job classification and function. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.2.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["7.2.3 Default “deny-all” setting. ","7.2.3 Confirm that the access control systems have a default “deny-all” setting. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.2.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["7.3 Ensure that security policies and operational procedures for restricting access to cardholder data are documented, in use, and known to all affected parties. ","7.3 Examine documentation interview personnel to verify that security policies and operational procedures for restricting access to cardholder data are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. ","Personnel need to be aware of and following security policies and operational procedures to ensure that access is controlled and based on need-to-know and least privilege, on a continuous basis.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"7.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"8","index":8,"n_rows":208,"n_cols":6,"rows_kept":208,"cut":false,"hidden":false,"merged":[[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[16,5,17,5],[17,3,18,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[34,5,35,5],[35,3,36,3],[55,0,63,0],[55,1,63,1],[55,2,63,2],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4],[52,5,53,5],[53,3,54,3],[73,0,81,0],[73,1,81,1],[73,2,81,2],[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[64,0,72,0],[64,1,72,1],[64,2,72,2],[64,4,66,4],[70,4,71,4],[70,5,71,5],[71,3,72,3],[91,0,99,0],[91,1,99,1],[91,2,99,2],[91,4,93,4],[97,4,98,4],[97,5,98,5],[98,3,99,3],[82,0,90,0],[82,1,90,1],[82,2,90,2],[82,4,84,4],[88,4,89,4],[88,5,89,5],[89,3,90,3],[109,0,117,0],[109,1,117,1],[109,2,117,2],[109,4,111,4],[115,4,116,4],[115,5,116,5],[116,3,117,3],[100,0,108,0],[100,1,108,1],[100,2,108,2],[100,4,102,4],[106,4,107,4],[106,5,107,5],[107,3,108,3],[127,0,135,0],[127,1,135,1],[127,2,135,2],[127,4,129,4],[133,4,134,4],[133,5,134,5],[134,3,135,3],[118,0,126,0],[118,1,126,1],[118,2,126,2],[118,4,120,4],[124,4,125,4],[124,5,125,5],[125,3,126,3],[145,0,153,0],[145,1,153,1],[145,2,153,2],[145,4,147,4],[151,4,152,4],[151,5,152,5],[152,3,153,3],[136,0,144,0],[136,1,144,1],[136,2,144,2],[136,4,138,4],[142,4,143,4],[142,5,143,5],[143,3,144,3],[163,0,171,0],[163,1,171,1],[163,2,171,2],[163,4,165,4],[169,4,170,4],[169,5,170,5],[170,3,171,3],[154,0,162,0],[154,1,162,1],[154,2,162,2],[154,4,156,4],[160,4,161,4],[160,5,161,5],[161,3,162,3],[181,0,189,0],[181,1,189,1],[181,2,189,2],[181,4,183,4],[187,4,188,4],[187,5,188,5],[188,3,189,3],[172,0,180,0],[172,1,180,1],[172,2,180,2],[172,4,174,4],[178,4,179,4],[178,5,179,5],[179,3,180,3],[199,0,207,0],[199,2,207,2],[199,1,207,1],[199,4,201,4],[205,4,206,4],[205,5,206,5],[206,3,207,3],[190,0,198,0],[190,1,198,1],[190,2,198,2],[190,4,192,4],[196,4,197,4],[196,5,197,5],[197,3,198,3]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["8.1 Define and implement policies and procedures to ensure proper user identification management for non-consumer users and administrators on all system components as follows: ","8.1.a Review procedures and confirm they define processes for each of the items below at 8.1.1 through 8.1.8\n\n8.1.b Verify that procedures are implemented for user identification management, by performing the following: ","By ensuring each user is uniquely identified—instead of using one ID for several employees—an organization can maintain individual responsibility for actions and an effective audit trail per employee. This will help speed issue resolution and containment when misuse or malicious intent occurs. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.1.1 Assign all users a unique ID \nbefore allowing them to access system \ncomponents or cardholder data. ","8.1.1 Interview administrative personnel to confirm that all users are assigned a unique ID for access to system components or cardholder data. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.1.2 Control addition, deletion, and modification of user IDs, credentials, and other identifier objects.","8.1.2 For a sample of privileged user IDs and general user IDs, examine associated authorizations and observe system settings to verify each user ID and privileged user ID has been implemented with only the privileges specified on the documented approval. ","To ensure that user accounts granted access to systems are all valid and recognized users, strong processes must manage all changes to user IDs and other authentication credentials, including adding \nnew ones and modifying or deleting existing ones. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.1.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.1.3 Immediately revoke access for any terminated users. ","8.1.3.a Select a sample of users terminated in the past six months, and review current user access lists—for both local and remote access—to verify that their IDs have been deactivated or removed from the access lists. \n\n8.1.3.b Verify all physical authentication methods—such as, smart cards, tokens, etc.—have been returned or deactivated. ","If an employee has left the company and still has access to the network via their user account, unnecessary or malicious access to cardholder data could occur—either by the former employee or by a malicious user who exploits the old and/or unused \naccount. To prevent unauthorized access, user credentials and other authentication methods therefore need to be revoked promptly (as soon as possible) upon the employee’s departure. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.1.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.1.4 Remove/disable inactive user \naccounts at least every 90 days. ","8.1.4 Observe user accounts to verify that any inactive accounts over 90 days old are either removed or disabled. ","Accounts that are not used regularly are often targets of attack since it is less likely that any changes (such as a changed password) will be noticed. As such, these accounts may be more easily exploited and used to access cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.1.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.1.5 Manage IDs used by vendors to access, support, or maintain system components via remote access as follows: \n\n. Enabled only during the time period needed and disabled when not in use. \n. Monitored when in use.","8.1.5.a Interview personnel and observe processes for managing accounts used by vendors to access, support, or maintain system components to verify that accounts used by vendors for remote access are: \n\n. Disabled when not in use \n. Enabled only when needed by the vendor, and disabled when not in use. \n\n8.1.5.b Interview personnel and observe processes to verify that vendor remote access accounts are monitored while being used. ","llowing vendors to have 24/7 access into your network in case they need to support your systems increases the chances of unauthorized access, either from a user in the vendor’s environment or from a malicious individual who finds and uses this \nalways-available external entry point into your network. Enabling access only for the time periods needed, and disabling it as soon as it is no longer needed, helps prevent misuse of these connections. \n\nMonitoring of vendor access provides assurance that vendors are accessing only the systems necessary and only during approved time frames.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.1.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.1.6 Limit repeated access attempts by locking out the user ID after not more than six attempts. ","8.1.6.a For a sample of system components, inspect system configuration settings to verify that authentication parameters are set to require that user accounts be locked out after not more than six invalid logon attempts. \n\n8.1.6.b Additional testing procedure for service providers: Review internal processes and customer/user documentation, and observe implemented processes to verify that non-\nconsumer user accounts are temporarily locked-out after not more than six invalid access attempts. ","Without account-lockout mechanisms in place, an attacker can continually attempt to guess a password through manual or automated tools (for example, password cracking), until they achieve success and gain access to a user’s account. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.1.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.1.7 Set the lockout duration to a \nminimum of 30 minutes or until an \nadministrator enables the user ID. ","8.1.7 For a sample of system components, inspect system configuration settings to verify that password parameters are set to require that once a user account is locked out, it remains locked for a minimum of 30 minutes or until a system \nadministrator resets the account. ","If an account is locked out due to someone \ncontinually trying to guess a password, controls to delay reactivation of these locked accounts stops the malicious individual from continually guessing \nthe password (they will have to stop for a minimum of 30 minutes until the account is reactivated). Additionally, if reactivation must be requested, the admin or help desk can validate that it is the actual account owner requesting reactivation.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.1.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.1.8 If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session.","8.1.8 For a sample of system components, inspect system configuration settings to verify that system/session idle time out features have been set to 15 minutes or less. ","When users walk away from an open machine with access to critical system components or cardholder data, that machine may be used by others in the \nuser’s absence, resulting in unauthorized account access and/or misuse. \n\nThe re-authentication can be applied either at the system level to protect all sessions running on that machine, or at the application level. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.1.8","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.2 In addition to assigning a unique ID, ensure proper user-authentication management for non-consumer users and administrators on all system components by employing at least one of the following methods to authenticate all users: \n\n. Something you know, such as a password or passphrase \n. Something you have, such as a token device or smart card \n. Something you are, such as a biometric. ","8.2 To verify that users are authenticated using unique ID and additional auth-entication (for example, a password / phrase) for access to the cardholder data environment, perform the \nfollowing: \n. Examine documentation describing the authentication method(s) used. \n. For each type of authentication method used and for each type of system component, observe an authentication to verify authentication is functioning consistent with documented authentication method(s). ","These authentication methods, when used in addition to unique IDs, help protect users’ IDs from being compromised, since the one attempting the compromise needs to know both the unique ID and the password (or other authentication used). Note that a digital certificate is a valid option for “something you have” as long as it is unique for a particular user. \n\nSince one of the first steps a malicious individual will take to compromise a system is to exploit weak or nonexistent passwords, it is important to implement good processes for authentication management",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.2.1 Using strong cryptography, render all authentication credentials (such as passwords/phrases) unreadable during transmission and storage on all system components.","8.2.1.a Examine vendor documentation and system \nconfiguration settings to verify that passwords are protected with strong cryptography during transmission and storage.\n\n8.2.1.b For a sample of system components, examine \npassword files to verify that passwords are unreadable during storage. \n\n8.2.1.c For a sample of system components, examine data transmissions to verify that passwords are unreadable during transmission. \n\n8.2.1.d Additional testing procedure for service providers: Observe password files to verify that customer passwords are unreadable during storage. \n\n8.2.1.e Additional testing procedure for service providers: Observe data transmissions to verify that customer passwords are unreadable during transmission.","Many network devices and applications transmit unencrypted, readable passwords across the network and/or store passwords without encryption. A malicious individual can easily intercept unencrypted passwords during transmission using a “sniffer,” or directly access unencrypted passwords \nin files where they are stored, and use this data to gain unauthorized access. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.2.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.2.2 Verify user identity before \nmodifying any authentication credential—for example, performing password resets, provisioning new tokens, or generating new keys.","8.2.2 Examine authentication procedures for modifying authentication credentials and observe security personnel to verify that, if a user requests a reset of an authentication credential by phone, e-mail, web, or other non-face-to-face method, the user’s identity is verified before the authentication \ncredential is modified. ","Many malicious individuals use \"social \nengineering”—for example, calling a help desk and acting as a legitimate user—to have a password changed so they can utilize a user ID. Consider use of a “secret question” that only the proper user can \nanswer to help administrators identify the user prior to re-setting or modifying authentication credentials.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.2.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.2.3 Passwords/phrases must meet the following: \n\n. Require a minimum length of at least seven characters. \n. Contain both numeric and alphabetic characters. \n\nAlternatively, the passwords/phrases must have complexity and strength at least equivalent to the parameters specified above. ","8.2.3a For a sample of system components, inspect system configuration settings to verify that user password parameters are set to require at least the following strength/complexity: \n\n. Require a minimum length of at least seven characters. \n. Contain both numeric and alphabetic characters. \n\n8.2.3.b Additional testing procedure for service providers: Review internal processes and customer/user documentation to verify that non-consumer user passwords are required to meet at least the following strength/complexity: \n\n. Require a minimum length of at least seven characters. \n. Contain both numeric and alphabetic characters. ","Strong passwords/phrases are the first line of defense into a network since a malicious individual will often first try to find accounts with weak or non-existent passwords. If passwords are short or simple \nto guess, it is relatively easy for a malicious \nindividual to find these weak accounts and \ncompromise a network under the guise of a valid user ID. \n\nThis requirement specifies that a minimum of seven characters and both numeric and alphabetic characters should be used for passwords/phrases. For cases where this minimum cannot be met due to \ntechnical limitations, entities can use “equivalent strength” to evaluate their alternative. NIST SP 800-63-1 defines “entropy” as “a measure of the difficulty \nof guessing or determining a password or key.” This document and others that discuss “password entropy” can be referred to for more information on applicable entropy value and for understanding equivalent password strength variability for \npasswords/phrases of different formats. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.2.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.2.4 Change user passwords/passphrases at least every 90 days. ","8.2.4.a For a sample of system components, inspect system configuration settings to verify that user password parameters are set to require users to change passwords at least every 90 days. \n\n8.2.4.b Additional testing procedure for service providers: Review internal processes and customer/user documentation \nto verify that: \n\n. Non-consumer user passwords are required to change periodically; and \n. Non-consumer users are given guidance as to when, and under what circumstances, passwords must change. ","Passwords/phrases that are valid for a long time without a change provide malicious individuals with more time to work on breaking the password/phrase. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.2.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.2.5 Do not allow an individual to submit a new password/phrase that is the same as any of the last four passwords/phrases he or she has used. ","8.2.5.a For a sample of system components, obtain and inspect system configuration settings to verify that password parameters are set to require that new passwords cannot be the same as the four previously used passwords. \n\nIf password history isn’t maintained, the \neffectiveness of changing passwords is reduced, as previous passwords can be reused over and over. Requiring that passwords cannot be reused for a period of time reduces the likelihood that passwords that have been guessed or brute-forced will be used in the future. ","If password history isn’t maintained, the effectiveness of changing passwords is reduced, as previous passwords can be reused over and over. Requiring that passwords cannot be reused for a period of time reduces the likelihood that passwords that have been guessed or brute-forced will be used in the future. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.2.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.2.6 Set passwords/phrases for first-time use and upon reset to a unique value for each user, and change immediately after the first use. ","8.2.6 Examine password procedures and observe security personnel to verify that first-time passwords for new users, and reset passwords for existing users, are set to a unique value for each user and changed after first use. ","If the same password is used for every new user, an internal user, former employee, or malicious individual may know or easily discover this password, and use it to gain access to accounts. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.2.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.3 Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, (including vendor access for support or maintenance). \n\nNote: Two-factor authentication requires that two of the three authentication methods (see Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered two-factor authentication. \n\nExamples of two-factor technologies \ninclude remote authentication and dial-in \nservice (RADIUS) with tokens; terminal \naccess controller access control system \n(TACACS) with tokens; and other \ntechnologies that facilitate two-factor \nauthentication. ","8.3.a Examine system configurations for remote access servers and systems to verify two-factor authentication is required for: \n\n. All remote access by personnel \n. All third-party/vendor remote access (including access to applications and system components for support or maintenance purposes).\n\n8.3.b Observe a sample of personnel (for example, users and administrators) connecting remotely to the network and verify that at least two of the three authentication methods are used. ","Two-factor authentication requires two forms of authentication for higher-risk accesses, such as those originating from outside the network \n\nThis requirement is intended to apply to all personnel—including general users, administrators, and vendors (for support or maintenance) with remote access to the network—where that remote access could lead to access to the cardholder data \nenvironment. \n\nIf remote access is to an entity’s network that has appropriate segmentation, such that remote users cannot access or impact the cardholder data environment, two-factor authentication for remote access to that network would not be required.  However, two-factor authentication is required for any remote access to networks with access to the cardholder data environment, and is recommended for all remote access to the entity’s networks. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.4 Document and communicate \nauthentication procedures and policies to \nall users including: \n\n. Guidance on selecting strong authentication credentials \n. Guidance for how users should protect their authentication credentials \n. Instructions not to reuse previously used passwords \n. Instructions to change passwords if there is any suspicion the password could be compromised. ","8.4.a Examine procedures and interview personnel to verify that authentication procedures and policies are distributed to all users.\n\n8.4.b Review authentication procedures and policies that are distributed to users and verify they include: \n\n. Guidance on selecting strong authentication credentials \n. Guidance for how users should protect their authentication credentials. \n. Instructions for users not to reuse previously used passwords \n. Instructions to change passwords if there is any suspicion the password could be compromised. \n\n\n8.4.c Interview a sample of users to verify that they are familiar with authentication procedures and policies. \n","Communicating password / authentication procedures to all users helps those users understand and abide by the policies. \n\nFor example, guidance on selecting strong passwords may include suggestions to help personnel select hard-to-guess passwords that don’t contain dictionary words, and that don’t contain information about the user (such as the user ID, names of family members, date of birth, etc.). \nGuidance for protecting authentication credentials \nmay include not writing down passwords or saving them in insecure files, and being alert for malicious \nindividuals who may attempt to exploit their passwords (for example, by calling an employee and asking for their password so the caller can \n“troubleshoot a problem”). \n\nInstructing users to change passwords if there is a chance the password is no longer secure can prevent malicious users from using a legitimate password to gain unauthorized access. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.5 Do not use group, shared, or generic IDs, passwords, or other authentication methods as follows: \n\n. Generic user IDs are disabled or removed. \n. Shared user IDs do not exist for system administration and other critical functions. \n. Shared and generic user IDs are not used to administer any system components. ","8.5 Do not use group, shared, or generic IDs, passwords, or other authentication methods as follows: \n\n. Generic user IDs are disabled or removed. \n. Shared user IDs do not exist for system administration and other critical functions. \n. Shared and generic user IDs are not used to administer any system components. \n\n8.5.b Examine authentication policies/procedures to verify that use of group and shared IDs and/or passwords or other authentication methods are explicitly prohibited. \n\n8.5.c Interview system administrators to verify that group and shared IDs and/or passwords or other authentication methods are not distributed, even if requested. ","If multiple users share the same authentication credentials (for example, user account and password), it becomes impossible to trace system access and activities to an individual. This in turn prevents an entity from assigning accountability for, or having effective logging of, an individual’s actions, since a given action could have been performed by anyone in the group that has knowledge of the authentication credentials. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.5.1 Additional requirement for service providers: Service providers with remote access to customer premises (for example, for support of POS systems or servers) must use a \nunique authentication credential (such \nas a password/phrase) for each customer. \n\nNote: This requirement is not intended to \napply to shared hosting providers accessing their own hosting environment, where multiple customer environments are hosted. \n\nNote: Requirement 8.5.1 is a best practice until June 30, 2015, after which it becomes a requirement.","8.5.1 Additional testing procedure for service providers: Examine authentication policies and procedures and interview personnel to verify that different authentication are used for access to each customer.","To prevent the compromise of multiple customers through the use of a single set of credentials, vendors with remote access accounts to customer environments should use a different authentication credential for each customer. \n\nTechnologies, such as two-factor mechanisms, that provide a unique credential for each connection (for \nexample, via a single-use password) could also meet the intent of this requirement.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.5.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.6 Where other authentication mechanisms are used (for example, physical or logical security tokens, smart cards, certificates, etc.), use of these mechanisms must be assigned as \nfollows: \n\n. Authentication mechanisms must be assigned to an individual account and not shared among multiple accounts. \n. Physical and/or logical controls must be in A164place to ensure only the intended account can use that mechanism to gain access. ","8.6.a Examine authentication policies and procedures to verify that procedures for using authentication mechanisms such as physical security tokens, smart cards, and certificates are defined and include: \n\n. Authentication mechanisms are assigned to an individual account and not shared among multiple accounts. \n. Physical and/or logical controls are defined to ensure only the intended account can use that mechanism to gain access. \n\n8.6.b Interview security personnel to verify authentication mechanisms are assigned to an account and not shared among multiple accounts. \n\n8.6.c Examine system configuration settings and/or physical controls, as applicable, to verify that controls are implemented to ensure only the intended account can use that mechanism to gain access.","If user authentication mechanisms such as tokens, smart cards, and certificates can be used by multiple accounts, it may be impossible to identify the individual using the authentication mechanism. Having physical and/or logical controls (for example, a PIN, biometric data, or a password) to uniquely identify the user of the account will prevent unauthorized users from gaining access through use of a shared authentication mechanism.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.7 All access to any database containing cardholder data (including access by applications, administrators, and all other users) is restricted as \nfollows: \n\n. All user access to, user queries of, and user actions on databases are through programmatic methods. \n. Only database administrators have the ability to directly access or query databases. \n. Application IDs for database applications can only be used by the applications (and not by individual users or other non-application \nprocesses). ","8.7.a Review database and application configuration settings and verify that all users are authenticated prior to access. \n\n8.7.b Examine database and application configuration settings to verify that all user access to, user queries of, and user actions on (for example, move, copy, delete), the database are through \nprogrammatic methods only (for example, through stored procedures). \n\n8.7.c Examine database access control settings and database application configuration settings to verify that user direct access to or queries of databases are restricted to database administrators. \n\n8.7.d Examine database access control settings, database application configuration settings, and the related application IDs to verify that application IDs can only be used by the applications (and not by individual users or other processes).","Without user authentication for access to databases and applications, the potential for unauthorized or malicious access increases, and such access cannot be logged since the user has not been authenticated and is therefore not known to the system. Also, database access should be granted \nthrough programmatic methods only (for example, through stored procedures), rather than via direct access to the database by end users (except for DBAs, who may need direct access to the database for their administrative duties). ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["8.8 Ensure that security policies and operational procedures for identification and authentication are documented, in use, and known to all affected parties.","8.8 Examine documentation interview personnel to verify that security policies and operational procedures for identification and authentication are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. ","Personnel need to be aware of and following security policies and operational procedures for managing identification and authorization on a continuous basis. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"8.8","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"9","index":9,"n_rows":244,"n_cols":6,"rows_kept":244,"cut":false,"hidden":false,"merged":[[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[16,5,17,5],[17,3,18,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[34,5,35,5],[35,3,36,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4],[52,5,53,5],[53,3,54,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[64,0,72,0],[64,1,72,1],[64,4,66,4],[70,4,71,4],[70,5,71,5],[71,3,72,3],[55,2,72,2],[55,0,63,0],[55,1,63,1],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[82,0,90,0],[82,1,90,1],[82,2,90,2],[82,4,84,4],[88,4,89,4],[88,5,89,5],[89,3,90,3],[73,0,81,0],[73,1,81,1],[73,2,81,2],[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[100,0,108,0],[100,1,108,1],[100,2,108,2],[100,4,102,4],[106,4,107,4],[106,5,107,5],[107,3,108,3],[91,0,99,0],[91,1,99,1],[91,2,99,2],[91,4,93,4],[97,4,98,4],[97,5,98,5],[98,3,99,3],[118,0,126,0],[118,1,126,1],[118,2,126,2],[118,4,120,4],[124,4,125,4],[124,5,125,5],[125,3,126,3],[109,0,117,0],[109,1,117,1],[109,2,117,2],[109,4,111,4],[115,4,116,4],[115,5,116,5],[116,3,117,3],[136,0,144,0],[136,1,144,1],[136,2,144,2],[136,4,138,4],[142,4,143,4],[142,5,143,5],[143,3,144,3],[127,0,135,0],[127,1,135,1],[127,2,135,2],[127,4,129,4],[133,4,134,4],[133,5,134,5],[134,3,135,3],[154,0,162,0],[154,1,162,1],[154,2,162,2],[154,4,156,4],[160,4,161,4],[160,5,161,5],[161,3,162,3],[145,0,153,0],[145,1,153,1],[145,2,153,2],[145,4,147,4],[151,4,152,4],[151,5,152,5],[152,3,153,3],[172,0,180,0],[172,1,180,1],[172,2,180,2],[172,4,174,4],[178,4,179,4],[178,5,179,5],[179,3,180,3],[163,0,171,0],[163,1,171,1],[163,2,171,2],[163,4,165,4],[169,4,170,4],[169,5,170,5],[170,3,171,3],[190,0,198,0],[190,1,198,1],[190,2,198,2],[190,4,192,4],[196,4,197,4],[196,5,197,5],[197,3,198,3],[181,0,189,0],[181,1,189,1],[181,2,189,2],[181,4,183,4],[187,4,188,4],[187,5,188,5],[188,3,189,3],[208,0,216,0],[208,1,216,1],[208,2,216,2],[208,4,210,4],[214,4,215,4],[214,5,215,5],[215,3,216,3],[199,0,207,0],[199,1,207,1],[199,2,207,2],[199,4,201,4],[205,4,206,4],[205,5,206,5],[206,3,207,3],[235,0,243,0],[235,1,243,1],[235,2,243,2],[235,4,237,4],[241,4,242,4],[241,5,242,5],[242,3,243,3],[223,5,224,5],[224,3,225,3],[226,2,234,2],[226,4,228,4],[232,5,233,5],[233,3,234,3],[226,0,234,0],[226,1,234,1],[232,4,233,4],[217,0,225,0],[217,1,225,1],[223,4,224,4],[217,2,225,2],[217,4,219,4]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["9.1 Use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment. ","9.1 Verify the existence of physical security controls for each computer room, data center, and other physical areas with systems in the cardholder data environment. \n\n. Verify that access is controlled with badge readers or other devices including authorized badges and lock and key. \n. Observe a system administrator’s attempt to log into consoles for randomly selected systems in the cardholder environment and verify that they are “locked” to prevent unauthorized use. ","Without physical access controls, such as badge systems and door controls, unauthorized persons could potentially gain access to the facility to steal, disable, disrupt, or destroy critical systems and cardholder data. \n\nLocking console login screens prevents unauthorized persons from gaining access to sensitive information, altering system \nconfigurations, introducing vulnerabilities into the network, or destroying records.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","YES"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.1.1 Use video cameras and/or access control mechanisms to monitor individual physical access to sensitive areas. Review collected data and correlate with other entries. Store for at least three months, unless otherwise restricted by law. \n\nNote: “Sensitive areas” refers to any data center, server room or any area that houses systems that store, process, or transmit cardholder data. This excludes public-facing areas where only point-of-sale terminals are present, such as the cashier areas in a retail store.","9.1.1.a Verify that video cameras and/or access control mechanisms are in place to monitor the entry/exit points to sensitive areas. \n\n9.1.1.b Verify that video cameras and/or access control mechanisms are protected from tampering or disabling. \n\n9.1.1.c Verify that video cameras and/or access control mechanisms are monitored and that data from cameras or other mechanisms is stored for at least three months. ","When investigating physical breaches, these controls can help identify the individuals that physically accessed the sensitive areas, as well as when they entered and exited. \n\nCriminals attempting to gain physical access to sensitive areas will often attempt to disable or bypass the monitoring controls. To protect these controls from tampering, video cameras could be positioned so they are out of reach and/or be monitored to detect tampering. Similarly, access \ncontrol mechanisms could be monitored or have physical protections installed to prevent them being damaged or disabled by malicious individuals. \n\nExamples of sensitive areas include corporate database server rooms, back-office rooms at retail locations that store cardholder data, and storage areas for large quantities of cardholder data. Sensitive areas should be identified by each \norganization to ensure the appropriate physical monitoring controls are implemented. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.1.2 Implement physical and/or logical controls to restrict access to publicly accessible network jacks. \n\nFor example, network jacks located in public areas and areas accessible to visitors could be disabled and only enabled when network access is explicitly authorized. Alternatively, \nprocesses could be implemented to ensure that visitors are escorted at all times in areas with active network jacks.","9.1.2 Interview responsible personnel and observe locations of publicly accessible network jacks to verify that physical and/or logical controls are in place to restrict access to publicly accessible network jacks. ","Restricting access to network jacks (or network ports) will prevent malicious individuals from plugging into readily available network jacks and gain access into internal network resources. \n\nWhether logical or physical controls, or a combination of both, are used, they should be sufficient to prevent an individual or device that is not explicitly authorized from being able to connect to the network. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.1.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.1.3 Restrict physical access to wireless access points, gateways, handheld devices, networking/communications hardware, and telecommunication lines. ","9.1.3 Verify that physical access to wireless access points, gateways, handheld devices, networking / communications hardware, and telecommunication lines is appropriately restricted. ","Without security over access to wireless components and devices, malicious users could use an organization’s unattended wireless devices to access network resources, or even connect their own devices to the wireless network to gain unauthorized access. Additionally, securing networking and communications hardware prevents malicious users from intercepting network traffic or physically connecting their own devices to wired network resources. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.1.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.2 Develop procedures to easily distinguish between onsite personnel and visitors, to include: \n\n. Identifying new onsite personnel or visitors (for example, assigning badges) \n. Changes to access requirements \n. Revoking or terminating onsite personnel and expired visitor identification (such as ID badges). ","9.2.a Review documented processes to verify that procedures are defined for identifying and distinguishing between onsite personnel and visitors. \n\n Verify procedures include the following: \n\n. Identifying new onsite personnel or visitors (for example, assigning badges), \n. Changing access requirements, and \n. Revoking terminated onsite personnel and expired visitor identification (such as ID badges) \n\n9.2.b Observe processes for identifying and distinguishing between onsite personnel and visitors to verify that: \n\n. Visitors are clearly identified, and \n. It is easy to distinguish between onsite personnel and visitors. \n\n9.2.c Verify that access to the identification process (such as a badge system) is limited to authorized personnel. \n\n9.2.d Examine identification methods (such as ID badges) in use to verify that they clearly identify visitors and it is easy to distinguish between onsite personnel and visitors.","Identifying authorized visitors so they are easily distinguished from onsite personnel prevents unauthorized visitors from being granted access to areas containing cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.3 Control physical access for onsite personnel to the sensitive areas as follows: \n\n. Access must be authorized and based on individual job function. \n. Access is revoked immediately upon termination, and all physical access mechanisms, such as keys, access cards, etc., are returned or disabled. ","9.3.a For a sample of onsite personnel with physical access to the CDE, interview responsible personnel and observe access control lists to verify that: \n\n. Access to the CDE is authorized. \n. Access is required for the individual’s job function. \n\n9.3.b Observe personnel access the CDE to verify that all personnel are authorized before being granted access. \n\n9.3.c Select a sample of recently terminated employees and review access control lists to verify the personnel do not have physical access to the CDE. \n","Controlling physical access to the CDE helps ensure that only authorized personnel with a legitimate business need are granted access. \n\nWhen personnel leave the organization, all physical access mechanisms should be returned or disabled promptly (as soon as possible) upon their departure, to ensure personnel cannot gain physical access to the CDE once their employment has ended. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.4 Implement procedures to identify and \nauthorize visitors. \n\nProcedures should include the following: ","9.4 Verify that visitor authorization and access controls are in place as follows: \n","Visitor controls are important to reduce the ability of unauthorized and malicious persons to gain access to facilities (and potentially, to cardholder data).\n\nVisitor controls ensure visitors are identifiable as visitors so personnel can monitor their activities, and that their access is restricted to just the duration of their legitimate visit. \n\nEnsuring that visitor badges are returned upon expiry or completion of the visit prevents malicious persons from using a previously authorized pass to gain physical access into the building after the visit \nhas ended. \n\nA visitor log documenting minimum information on the visitor is easy and inexpensive to maintain and will assist in identifying physical access to a building or room, and potential access to cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.4.1 Visitors are authorized before \nentering, and escorted at all times \nwithin, areas where cardholder data is \nprocessed or maintained. ","9.4.1.a Observe procedures and interview personnel to verify that visitors must be authorized before they are granted access to, and escorted at all times within, areas where cardholder data is processed or maintained. \n\n9.4.1.b Observe the use of visitor badges or other identification to verify that a physical token badge does not permit unescorted access to physical areas where cardholder data is processed or maintained. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.4.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.4.2 Visitors are identified and given a badge or other identification that expires and that visibly distinguishes the visitors from onsite personnel.","9.4.2.a Observe people within the facility to verify the use of visitor badges or other identification, and that visitors are easily distinguishable from onsite personnel. \n\n9.4.2.b Verify that visitor badges or other identification expire. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.4.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.4.3 Visitors are asked to surrender the badge or identification before leaving the facility or at the date of expiration. ","9.4.3 Observe visitors leaving the facility to verify visitors are asked to surrender their badge or other identification upon departure or expiration. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.4.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.4.4 A visitor log is used to maintain a physical audit trail of visitor activity to the facility as well as computer rooms and data centers where cardholder data is stored or transmitted. \n\nDocument the visitor’s name, the firm represented, and the onsite personnel authorizing physical access on the log. \n\nRetain this log for a minimum of three months, unless otherwise restricted by law. ","9.4.4.a Verify that a visitor log is in use to record physical access to the facility as well as computer rooms and data centers where cardholder data is stored or transmitted. \n\n9.4.4.b Verify that the log contains: \n\n. The visitor’s name, \n. The firm represented, and \n. The onsite personnel authorizing physical access. \n\n9.4.4.c Verify that the log is retained for at least three months. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.4.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.5 Physically secure all media. ","9.5 Verify that procedures for protecting cardholder data include controls for physically securing all media (including but not limited to computers, removable electronic media, paper receipts, paper \nreports, and faxes). ","Controls for physically securing media are intended to prevent unauthorized persons from gaining access to cardholder data on any type of media. Cardholder data is susceptible to unauthorized viewing, copying, or scanning if it is unprotected while it is on removable or portable media, printed out, or left on someone’s desk.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.5.1 Store media backups in a secure location, preferably an off-site facility, such as an alternate or backup site, or a commercial storage facility. Review the location’s security at least annually.","9.5.1.a Observe the storage location’s physical security to confirm that backup media storage is secure.\n\n9.5.1.b Verify that the storage location security is reviewed at least annually. \n\nPeriodically reviewing the storage facility enables \nthe organization to address identified security \nissues in a timely manner, minimizing the potential \nrisk.","If stored in a non-secured facility, backups that contain cardholder data may easily be lost, stolen, or copied for malicious intent.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.5.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.6 Maintain strict control over the \ninternal or external distribution of any \nkind of media, including the following: ","9.6 Verify that a policy exists to control distribution of media, and that the policy covers all distributed media including that distributed to individuals. ","Procedures and processes help protect cardholder data on media distributed to internal and/or external users. Without such procedures data can be lost or stolen and used for fraudulent purposes.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.6.1 Classify media so the sensitivity \nof the data can be determined.","9.6.1 Verify that all media is classified so the sensitivity of the data can be determined. ","It is important that media be identified such that its classification status can be easily discernible. Media not identified as confidential may not be adequately protected or may be lost or stolen. \n\nNote: This does not mean the media needs to have a “Confidential” label attached; the intent is that the organization has identified media that contains sensitive data so it can protect it. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.6.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.6.2 Send the media by secured \ncourier or other delivery method that \ncan be accurately tracked. ","9.6.2.a Interview personnel and examine records to verify that all media sent outside the facility is logged and sent via secured courier or other delivery method that can be tracked. \n\n9.6.2.b Select a recent sample of several days of offsite tracking logs for all media, and verify tracking details are documented.","Media may be lost or stolen if sent via a non-trackable method such as regular postal mail. Use of secure couriers to deliver any media that contains cardholder data allows organizations to use their tracking systems to maintain inventory \nand location of shipments. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.6.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.6.3 Ensure management approves \nany and all media that is moved from a \nsecured area (including when media is \ndistributed to individuals). ","9.6.3 Select a recent sample of several days of offsite tracking logs for all media. From examination of the logs and interviews with responsible personnel, verify proper management authorization is obtained whenever media is moved from a secured area (including when media is distributed to individuals). ","Without a firm process for ensuring that all media movements are approved before the media is removed from secure areas, the media would not be tracked or appropriately protected, and its location would be unknown, leading to lost or stolen media. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.6.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.7 Maintain strict control over the storage and accessibility of media. ","9.7 Obtain and examine the policy for controlling storage and maintenance of all media and verify that the policy requires periodic media inventories. ","Without careful inventory methods and storage controls, stolen or missing media could go unnoticed for an indefinite amount of time. \n\nIf media is not inventoried, stolen or lost media may not be noticed for a long time or at all.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.7.1 Properly maintain inventory logs of all media and conduct media inventories at least annually. ","9.7.1 Review media inventory logs to verify that logs are maintained and media inventories are performed at least annually. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.7.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.8 Destroy media when it is no longer needed for business or legal reasons as follows: ","9.8 Examine the periodic media destruction policy and verify that it covers all media and defines requirements for the following: \n\n. Hard-copy materials must be crosscut shredded, incinerated, or pulped such that there is reasonable assurance the hard-copy materials cannot be reconstructed. \n\n. Storage containers used for materials that are to be destroyed must be secured. \n\n. Cardholder data on electronic media must be rendered unrecoverable via a secure wipe program (in accordance with industry-accepted standards for secure deletion), or by physically destroying the media. ","If steps are not taken to destroy information contained on hard disks, portable drives, CD/DVDs, or paper prior to disposal, malicious individuals may be able to retrieve information from the disposed media, leading to a data compromise. \nFor example, malicious individuals may use a technique known as “dumpster diving,” where they search through trashcans and recycle bins looking for information they can use to launch an attack. \n\nSecuring storage containers used for materials that are going to be destroyed prevents sensitive information from being captured while the materials are being collected. For example, “to-be-shredded” containers could have a lock preventing access to its contents or physic ally prevent access to the inside of the container. \n\nExamples of methods for securely destroying electronic media include secure wiping, degaussing, or physical destruction (such as grinding or shredding hard disks). ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.8","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.8.1 Shred, incinerate, or pulp hard-copy materials so that cardholder data cannot be reconstructed. Secure storage containers used for materials that are to be destroyed. ","9.8.1.a Interview personnel and examine procedures to verify that hard-copy materials are crosscut shredded, incinerated, or pulped such that there is reasonable assurance the hard-copy materials cannot be reconstructed. \n\n9.8.1.b Examine storage containers used for materials that contain information to be destroyed to verify that the containers are secured. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.8.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.8.2 Render cardholder data on electronic media unrecoverable so that cardholder data cannot be reconstructed. ","9.8.2 Verify that cardholder data on electronic media is rendered unrecoverable via a secure wipe program in accordance with industry-accepted standards for secure deletion, or otherwise physically destroying the media). ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.8.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.9 Protect devices that capture payment card data via direct physical interaction with the card from tampering and substitution. \n\nNote: These requirements apply to card-reading devices used in card-present transactions (that is, card swipe or dip) at the point of sale. This requirement is not intended to apply to manual key-entry components such as computer \nkeyboards and POS keypads. \n\nNote: Requirement 9.9 is a best practice until June 30, 2015, after which it becomes a requirement. ","9.9 Examine documented policies and procedures to verify they include: \n\n. Maintaining a list of devices \n. Periodically inspecting devices to look for tampering or substitution \n. Training personnel to be aware of suspicious behavior and to report tampering or substitution of devices. ","Criminals attempt to steal cardholder data by stealing and/or manipulating card-reading devices and terminals. For example, they will try to steal devices so they can learn how to break into them, and they often try to replace legitimate devices with fraudulent devices that send them payment card information every time a card is entered. Criminals will also try to add “skimming” components to the outside of devices, which are designed to capture payment card details before they even enter the device—for example, by attaching an additional card reader on top of the legitimate card reader so that the payment card details are captured twice: once by the criminal’s component and then by the device’s legitimate component. In this way, transactions may still be completed without interruption while the criminal is “skimming” the payment card information during the process. \n\nThis requirement is recommended, but not required, for manual key-entry components such as computer keyboards and POS keypads. \n\nAdditional best practices on skimming prevention are available on the PCI SSC website. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.9","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.9.1 Maintain an up-to-date list of devices. The list should include the following: \n\n. Make, model of device \n. Location of device (for example, the address of the site or facility where the device is located) \n. Device serial number or other method of unique identification. \n","9.9.1.a Examine the list of devices to verify it includes: \n\n. Make, model of device \n. Location of device (for example, the address of the site or facility where the device is located) \n. Device serial number or other method of unique identification. \n\n9.9.1.b Select a sample of devices from the list and observe device locations to verify that the list is accurate and up to date. \n\n9.9.1.c Interview personnel to verify the list of devices is updated when devices are added, relocated, decommissioned, etc. ","Keeping an up-to-date list of devices helps an organization keep track of where devices are supposed to be, and quickly identify if a device is missing or lost. \n\nThe method for maintaining a list of devices may be automated (for example, a device-management system) or manual (for example, documented in electronic or paper records). For on-the-road devices, the location may include the name of the \npersonnel to whom the device is assigned. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.9.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D211,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D211,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.9.2 Periodically inspect device surfaces to detect tampering (for example, addition of card skimmers to devices), or substitution (for example, by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device). \n\nNote: Examples of signs that a device might have been tampered with or substituted include unexpected attachments or cables plugged into the device, missing or changed security labels, broken or differently colored \ncasing, or changes to the serial number or other external markings. ","9.9.2.a Examine documented procedures to verify processes are defined to include the following: \n\n. Procedures for inspecting devices \n. Frequency of inspections. \n\n9.9.2.b Interview responsible personnel and observe inspection processes to verify: \n\n. Personnel are aware of procedures for inspecting devices. \n. All devices are periodically inspected for evidence of tampering and substitution. ","Regular inspections of devices will help organizations to more quickly detect tampering or replacement of a device, and thereby minimize the potential impact of using fraudulent devices. \n\nThe type of inspection will depend on the device—for example, photographs of devices that are known to be secure can be used to compare a device’s current appearance with its original appearance to see whether it has changed. Another option may be to use a secure marker pen, such as a UV light marker, to mark device surfaces and device openings so any tampering or replacement will be apparent. Criminals will often replace the outer casing of a device to hide their tampering, and these methods may help to detect such activities. Device vendors may also be able to provide security guidance and “how to” guides to help determine whether the device has been tampered with. \n\nThe frequency of inspections will depend on factors such as location of device and whether the device is attended or unattended. For example, devices left in public areas without supervision by the organization’s personnel may have more frequent inspections than devices that are kept in secure areas or are supervised when they are accessible to the public. The type and frequency of inspections is determined by the merchant, as defined by their annual risk-assessment process. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.9.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D220,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D220,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.9.3 Provide training for personnel to be aware of attempted tampering or replacement of devices. Training should include the following: \n\n. Verify the identity of any third-party persons claiming to be repair or maintenance personnel, prior to granting them access to modify or \ntroubleshoot devices. \n. Do not install, replace, or return devices without verification. \n. Be aware of suspicious behavior around devices (for example, attempts by unknown persons to unplug or open devices). \n. Report suspicious behavior and indications of device tampering or substitution to appropriate \npersonnel (for example, to a manager or security officer). ","9.9.3.a Review training materials for personnel at point-of-sale locations to verify they include training in the following: \n\n. Verifying the identity of any third-party persons claiming to be repair or maintenance personnel, prior to granting them access to modify or troubleshoot devices \n. Not to install, replace, or return devices without verification \n. Being aware of suspicious behavior around devices (for example, attempts by unknown persons to unplug or open devices) \n. Reporting suspicious behavior and indications of device tampering or substitution to appropriate personnel (for example, to a manager or security officer). \n\n9.9.3.b Interview a sample of personnel at point-of-sale locations to verify they have received training and are aware of the procedures for the following: \n\n. Verifying the identity of any third-party persons claiming to be repair or maintenance personnel, prior to granting them access to modify or troubleshoot devices \n. Not to install, replace, or return devices without verification \n. Being aware of suspicious behavior around devices (for example, attempts by unknown persons to unplug or open devices) \n. Reporting suspicious behavior and indications of device tampering or substitution to appropriate personnel (for example, to a manager or security officer). \n","Criminals will often pose as authorized maintenance personnel in order to gain access to POS devices. All third parties requesting access to devices should always be verified before being provided access—for example, by checking with \nmanagement or phoning the POS maintenance company (such as the vendor or acquirer) for verification. Many criminals will try to fool personnel by dressing for the part (for example, carrying toolboxes and dressed in work wear), and could also be knowledgeable about locations of devices, so it’s important personnel are trained to follow procedures at all times. \n\nAnother trick criminals like to use is to send a “new” POS system with instructions for swapping it with a legitimate system and “returning” the legitimate system to a specified address. The criminals may \neven provide return postage as they are very keen to get their hands on these devices. Personnel always verify with their manager or supplier that the device is legitimate and came from a trusted source before installing it or using it for business. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.9.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D229,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D229,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["9.10 Ensure that security policies and operational procedures for restricting physical access to cardholder data are documented, in use, and known to all affected parties.","9.10 Examine documentation and interview personnel to verify that security policies and operational procedures for restricting physical access to cardholder data are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. \n","Personnel need to be aware of and following security policies and operational procedures for restricting physical access to cardholder data and CDE systems on a continuous basis. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"9.10","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D238,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D238,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"10","index":10,"n_rows":289,"n_cols":6,"rows_kept":289,"cut":false,"hidden":false,"merged":[[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[34,5,35,5],[35,3,36,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[16,5,17,5],[17,3,18,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4],[52,5,53,5],[53,3,54,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[64,0,72,0],[64,1,72,1],[64,2,72,2],[64,4,66,4],[70,4,71,4],[70,5,71,5],[71,3,72,3],[55,0,63,0],[55,1,63,1],[55,2,63,2],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[82,0,90,0],[82,1,90,1],[82,2,90,2],[82,4,84,4],[88,4,89,4],[88,5,89,5],[89,3,90,3],[73,0,81,0],[73,1,81,1],[73,2,81,2],[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[100,0,108,0],[100,1,108,1],[100,2,108,2],[100,4,102,4],[106,4,107,4],[106,5,107,5],[107,3,108,3],[91,0,99,0],[91,1,99,1],[91,2,99,2],[91,4,93,4],[97,4,98,4],[97,5,98,5],[98,3,99,3],[118,0,126,0],[118,1,126,1],[118,2,126,2],[118,4,120,4],[124,4,125,4],[124,5,125,5],[125,3,126,3],[109,0,117,0],[109,1,117,1],[109,2,117,2],[109,4,111,4],[115,4,116,4],[115,5,116,5],[116,3,117,3],[136,0,144,0],[136,1,144,1],[136,2,144,2],[136,4,138,4],[142,4,143,4],[142,5,143,5],[143,3,144,3],[127,0,135,0],[127,1,135,1],[127,2,135,2],[127,4,129,4],[133,4,134,4],[133,5,134,5],[134,3,135,3],[154,0,162,0],[154,1,162,1],[154,2,162,2],[154,4,156,4],[160,4,161,4],[160,5,161,5],[161,3,162,3],[145,0,153,0],[145,1,153,1],[145,2,153,2],[145,4,147,4],[151,4,152,4],[151,5,152,5],[152,3,153,3],[172,0,180,0],[172,1,180,1],[172,2,180,2],[172,4,174,4],[178,4,179,4],[178,5,179,5],[179,3,180,3],[163,0,171,0],[163,1,171,1],[163,2,171,2],[163,4,165,4],[169,4,170,4],[169,5,170,5],[170,3,171,3],[190,0,198,0],[190,1,198,1],[190,2,198,2],[190,4,192,4],[196,4,197,4],[196,5,197,5],[197,3,198,3],[181,0,189,0],[181,1,189,1],[181,2,189,2],[181,4,183,4],[187,4,188,4],[187,5,188,5],[188,3,189,3],[208,0,216,0],[208,1,216,1],[208,2,216,2],[208,4,210,4],[214,4,215,4],[214,5,215,5],[215,3,216,3],[199,0,207,0],[199,1,207,1],[199,2,207,2],[199,4,201,4],[205,4,206,4],[205,5,206,5],[206,3,207,3],[226,0,234,0],[226,1,234,1],[226,2,234,2],[226,4,228,4],[232,4,233,4],[232,5,233,5],[233,3,234,3],[217,0,225,0],[217,1,225,1],[217,2,225,2],[217,4,219,4],[223,4,224,4],[223,5,224,5],[224,3,225,3],[244,0,252,0],[244,1,252,1],[244,2,252,2],[244,4,246,4],[250,4,251,4],[250,5,251,5],[251,3,252,3],[235,0,243,0],[235,1,243,1],[235,2,243,2],[235,4,237,4],[241,4,242,4],[241,5,242,5],[242,3,243,3],[262,0,270,0],[262,1,270,1],[262,2,270,2],[262,4,264,4],[268,4,269,4],[268,5,269,5],[269,3,270,3],[253,0,261,0],[253,1,261,1],[253,2,261,2],[253,4,255,4],[259,4,260,4],[259,5,260,5],[260,3,261,3],[280,0,288,0],[280,1,288,1],[280,2,288,2],[280,4,282,4],[286,4,287,4],[286,5,287,5],[287,3,288,3],[271,0,279,0],[271,1,279,1],[271,2,279,2],[271,4,273,4],[277,4,278,4],[277,5,278,5],[278,3,279,3]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["10.1 Implement audit trails to link all access to system components to each individual user. ","10.1 Verify, through observation and interviewing the system administrator, that: \n\n. Audit trails are enabled and active for system components. \n. Access to system components is linked to individual users. ","It is critical to have a process or system that links user access to system components accessed. This system generates audit logs and provides the ability to trace back suspicious activity to a specific user. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.2 Implement automated audit trails for all system components to reconstruct the following events: ","10.2 Through interviews of responsible personnel, observation of audit logs, and examination of audit log settings, perform the following: ","Generating audit trails of suspect activities alerts the system administrator, sends data to other monitoring mechanisms (like intrusion detection systems), and provides a history trail for post-incident follow-up. Logging of the following events enables an organization to identify and trace potentially malicious activities ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.2.1 All individual user accesses to \ncardholder data ","10.2.1 Verify all individual access to cardholder data is logged. ","Malicious individuals could obtain knowledge of a user account with access to systems in the CDE, or they could create a new, unauthorized account in order to access cardholder data. A record of all \nindividual accesses to cardholder data can identify which accounts may have been compromised or misused. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.2.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.2.2 All actions taken by any individual with root or administrative privileges ","10.2.2 Verify all actions taken by any individual with root or administrative privileges are logged. ","Accounts with increased privileges, such as the “administrator” or “root” account, have the potential to greatly impact the security or operational functionality of a system. Without a log of the activities performed, an organization is unable to trace any issues resulting from an administrative mistake or misuse of privilege back to the specific action and individual. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.2.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.2.3 Access to all audit trails ","10.2.3 Verify access to all audit trails is logged. ","Malicious users often attempt to alter audit logs to hide their actions, and a record of access allows an organization to trace any inconsistencies or potential tampering of the logs to an individual account. Having access to logs identifying changes, additions, and deletions can help retrace \nsteps made by unauthorized personnel. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.2.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.2.4 Invalid logical access attempts ","10.2.4 Verify invalid logical access attempts are logged. ","Malicious individuals will often perform multiple access attempts on targeted systems. Multiple invalid login attempts may be an indication of an unauthorized user’s attempts to “brute force” or guess a password. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.2.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.2.5 Use of and changes to identification and authentication mechanisms—including but not limited to creation of new accounts and \nelevation of privileges—and all changes, additions, or deletions to accounts with root or administrative privileges ","10.2.5.a Verify use of identification and authentication mechanisms is logged.\n\n10.2.5.b Verify all elevation of privileges is logged. \n\n10.2.5.c Verify all changes, additions, or deletions to any account with root or administrative privileges are logged. ","Without knowing who was logged on at the time of an incident, it is impossible to identify the accounts that may have been used. Additionally, malicious users may attempt to manipulate the authentication controls with the intent of bypassing them or impersonating a valid account. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.2.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.2.6 Initialization, stopping, or \npausing of the audit logs ","10.2.6 Verify the following are logged: \n\n. Initialization of audit logs \n. Stopping or pausing of audit logs. ","Turning the audit logs off (or pausing them) prior to performing illicit activities is a common practice for malicious users wishing to avoid detection. Initialization of audit logs could indicate that the log function was disabled by a user to hide their actions. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.2.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.2.7 Creation and deletion of system-\nlevel objects ","10.2.7 Verify creation and deletion of system level objects are logged.","Malicious software, such as malware, often \ncreates or replaces system level objects on the target system in order to control a particular function or operation on that system. By logging when system-level objects, such as database tables or stored procedures, are created or deleted, it will be easier to determine whether such modifications were authorized. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.2.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.3 Record at least the following audit trail entries for all system components for each event: ","10.3 Through interviews and observation of audit logs, for each auditable event (from 10.2), perform the following: ","By recording these details for the auditable events at 10.2, a potential compromise can be quickly identified, and with sufficient detail to know who, what, where, when, and how. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.3.1 User identification ","10.3.1 Verify user identification is included in log entries. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.3.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.3.2 Type of event ","10.3.2 Verify type of event is included in log entries. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.3.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.3.3 Date and time ","10.3.3 Verify date and time stamp is included in log entries. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.3.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.3.4 Success or failure indication","10.3.4 Verify success or failure indication is included in log entries. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.3.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.3.5 Origination of event ","10.3.5 Verify origination of event is included in log entries. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.3.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.3.6 Identity or name of affected data, system component, or resource. ","10.3.6 Verify identity or name of affected data, system component, or resources is included in log entries. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.3.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.4 Using time-synchronization technology, synchronize all critical system clocks and times and ensure that the following is implemented for acquiring, distributing, and storing time. \n\nNote: One example of time synchronization technology is Network Time Protocol (NTP). ","10.4 Examine configuration standards and processes to verify that time-synchronization technology is implemented and kept current per PCI DSS Requirements 6.1 and 6.2. ","Time synchronization technology is used to synchronize clocks on multiple systems. When clocks are not properly synchronized, it can be difficult, if not impossible, to compare log files from different systems and establish an exact sequence of event (crucial for forensic analysis in the event of a breach). For post-incident forensics teams, the accuracy and consistency of time across all systems and the time of each activity is critical in determining how the systems were compromised. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.4.1 Critical systems have the correct and consistent time. ","10.4.1.a Examine the process for acquiring, distributing and storing the correct time within the organization to verify that: \n\n. Only the designated central time server(s) receives time signals from external sources, and time signals from external sources are based on International Atomic Time or UTC. \n. Where there is more than one designated time server, the time servers peer with one another to keep accurate time, \n. Systems receive time information only from designated central time server(s).\n\n10.4.1.b Observe the time-related system-parameter settings for a sample of system components to verify: \n\n. Only the designated central time server(s) receives time signals from external sources, and time signals from external sources are based on International Atomic Time or UTC. \n. Where there is more than one designated time server, the designated central time server(s) peer with one another to keep accurate time. \n. Systems receive time only from designated central time server(s). \n",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.4.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.4.2 Time data is protected.","10.4.2.a Examine system configurations and time-\nsynchronization settings to verify that access to time data is restricted to only personnel with a business need to access time data. \n\n10.4.2.b Examine system configurations, time synchronization settings and logs, and processes to verify that any changes to time settings on critical systems are logged, monitored, and reviewed.",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.4.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.4.3 Time settings are received from industry-accepted time sources. ","10.4.3 Examine systems configurations to verify that the time server(s) accept time updates from specific, industry-accepted external sources (to prevent a malicious individual from changing the clock). Optionally, those updates can be encrypted with a \nsymmetric key, and access control lists can be created that specify the IP addresses of client machines that will be provided with the time updates (to prevent unauthorized use of internal \ntime servers). ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.4.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.5 Secure audit trails so they cannot be altered. ","10.5 Interview system administrators and examine system configurations and permissions to verify that audit trails are secured so that they cannot be altered as follows: ","Often a malicious individual who has entered the network will attempt to edit the audit logs in order to hide their activity. Without adequate protection of audit logs, their completeness, accuracy, and integrity cannot be guaranteed, and the audit logs \ncan be rendered useless as an investigation tool after a compromise. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.5.1 Limit viewing of audit trails to those with a job-related need. ","10.5.1 Only individuals who have a job-related need can view audit trail files. \n","Adequate protection of the audit logs includes strong access control (limit access to logs based on “need to know” only), and use of physical or network segregation to make the logs harder to find and modify. \n\nPromptly backing up the logs to a centralized log server or media that is difficult to alter keeps the logs protected even if the system generating the \nlogs becomes compromised. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.5.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.5.2 Protect audit trail files from unauthorized modifications. ","10.5.2 Current audit trail files are protected from unauthorized modifications via access control mechanisms, physical segregation, and/or network segregation. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.5.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter. ","10.5.3 Current audit trail files are promptly backed up to a centralized log server or media that is difficult to alter. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.5.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D211,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D211,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.5.4 Write logs for external-facing technologies onto a secure, centralized, internal log server or media device. ","10.5.4 Logs for external-facing technologies (for example, wireless, firewalls, DNS, mail) are written onto a secure, centralized, internal log server or media. ","By writing logs from external-facing technologies such as wireless, firewalls, DNS, and mail servers, the risk of those logs being lost or altered is lowered, as they are more secure within the internal network. \n\nLogs may be written directly, or offloaded or copied from external systems, to the secure internal system or media. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.5.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D220,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D220,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.5.5 Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert). ","10.5.5 Examine system settings, monitored files, and results from monitoring activities to verify the use of file-integrity monitoring or change-detection software on logs. ","File-integrity monitoring or change-detection systems check for changes to critical files, and notify when such changes are noted. For file-integrity monitoring purposes, an entity usually monitors files that don’t regularly change, but when changed indicate a possible compromise. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.5.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D229,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D229,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.6 Review logs and security events for all system components to identify anomalies or suspicious activity. \n\nNote: Log harvesting, parsing, and alerting tools may be used to meet this Requirement. ","10.6 Perform the following: ","Many breaches occur over days or months before being detected. Checking logs daily minimizes the amount of time and exposure of a potential breach. \n\nRegular log reviews by personnel or automated means can identify and proactively address unauthorized access to the cardholder data environment. \n\nThe log review process does not have to be manual. The use of log harvesting, parsing, and alerting tools can help facilitate the process by identifying log events that need to be reviewed. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D238,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D238,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.6.1 Review the following at least \ndaily: \n\n. All security events \n. Logs of all system components that store, process, or transmit CHD and/or SAD, or that could impact the security of CHD and/or SAD \n. Logs of all critical system components \n. Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems/intrusion-prevention systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.). ","10.6.1.a Examine security policies and procedures to verify that procedures are defined for reviewing the following at least daily, either manually or via log tools: \n\n. All security events \n. Logs of all system components that store, process, or transmit CHD and/or SAD, or that could impact the security of CHD and/or SAD \n. Logs of all critical system components \n. Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems/intrusion-prevention systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.) \n\n10.6.1.b Observe processes and interview personnel to verify that the following are reviewed at least daily: \n\n. All security events \n. Logs of all system components that store, process, or transmit CHD and/or SAD, or that could impact the security of CHD and/or SAD \n. Logs of all critical system components \n. Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems/intrusion-prevention systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.). ","Many breaches occur over days or months before being detected. Checking logs daily minimizes the amount of time and exposure of a potential breach. \n\nDaily review of security events—for example, notifications or alerts that identify suspicious or anomalous activities—as well as logs from critical system components, and logs from systems that perform security functions, such as firewalls, IDS/IPS, file-integrity monitoring (FIM) systems, etc. is necessary to identify potential issues. Note that the determination of “security event” will vary \nfor each organization and may include consideration for the type of technology, location, and function of the device. Organizations may also wish to maintain a baseline of “normal” traffic to help identify anomalous behavior. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.6.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D247,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D247,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.6.2 Review logs of all other system components periodically based on the organization’s policies and risk management strategy, as determined by the organization’s annual risk assessment. ","10.6.2.a Examine security policies and procedures to verify that procedures are defined for reviewing logs of all other system components periodically—either manually or via log tools—based on the organization’s policies and risk management strategy. \n\n10.6.2.b Examine the organization’s risk-assessment \ndocumentation and interview personnel to verify that reviews are performed in accordance with organization’s policies and risk management strategy. ","Logs for all other system components should also be periodically reviewed to identify indications of potential issues or attempts to gain access to sensitive systems via less-sensitive systems. The frequency of the reviews should be determined by \nan entity’s annual risk assessment. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.6.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D256,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D256,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.6.3 Follow up exceptions and anomalies identified during the review process. ","10.6.3.a Examine security policies and procedures to verify that procedures are defined for following up on exceptions and anomalies identified during the review process. \n\n10.6.3.b Observe processes and interview personnel to verify that follow-up to exceptions and anomalies is performed. ","If exceptions and anomalies identified during the log-review process are not investigated, the entity may be unaware of unauthorized and potentially malicious activities that are occurring within their \nown network. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.6.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D265,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D265,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.7 Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from backup). ","10.7.a Examine security policies and procedures to verify that they define the following: \n\n. Audit log retention policies \n. Procedures for retaining audit logs for at least one year, with a minimum of three months immediately available online. \n\n10.7.b Interview personnel and examine audit logs to verify that audit logs are available for at least one year. \n\n10.7.c Interview personnel and observe processes to verify that at least the last three months’ logs can be immediately restored for analysis. ","Retaining logs for at least a year allows for the fact that it often takes a while to notice that a compromise has occurred or is occurring, and allows investigators sufficient log history to better determine the length of time of a potential breach \nand potential system(s) impacted. By having three months of logs immediately available, an entity can quickly identify and minimize impact of a data breach. Storing logs in off-line locations could prevent them from being readily available, \nresulting in longer time frames to restore log data, perform analysis, and identify impacted systems or data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D274,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D274,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["10.8 Ensure that security policies and operational procedures for monitoring all access to network resources and cardholder data are documented, in use, and known to all affected parties. ","10.8 Examine documentation interview personnel to verify that security policies and operational procedures for monitoring all access to network resources and cardholder data are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. ","Personnel need to be aware of and following security policies and daily operational procedures for monitoring all access to network resources and \ncardholder data on a continuous basis. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.8","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D283,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D283,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"11","index":11,"n_rows":145,"n_cols":6,"rows_kept":145,"cut":false,"hidden":false,"merged":[[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[16,5,17,5],[17,3,18,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[34,5,35,5],[35,3,36,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4],[52,5,53,5],[53,3,54,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[64,0,72,0],[64,1,72,1],[64,2,72,2],[64,4,66,4],[70,4,71,4],[70,5,71,5],[71,3,72,3],[55,0,63,0],[55,1,63,1],[55,2,63,2],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[82,0,90,0],[82,1,90,1],[82,2,90,2],[82,4,84,4],[88,4,89,4],[88,5,89,5],[89,3,90,3],[73,0,81,0],[73,1,81,1],[73,2,81,2],[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[100,0,108,0],[100,1,108,1],[100,2,108,2],[100,4,102,4],[106,4,107,4],[106,5,107,5],[107,3,108,3],[91,0,99,0],[91,1,99,1],[91,2,99,2],[91,4,93,4],[97,4,98,4],[97,5,98,5],[98,3,99,3],[118,0,126,0],[118,1,126,1],[118,2,126,2],[118,4,120,4],[124,4,125,4],[124,5,125,5],[125,3,126,3],[109,0,117,0],[109,1,117,1],[109,2,117,2],[109,4,111,4],[115,4,116,4],[115,5,116,5],[116,3,117,3],[136,0,144,0],[136,1,144,1],[136,2,144,2],[136,4,138,4],[142,4,143,4],[142,5,143,5],[143,3,144,3],[127,0,135,0],[127,1,135,1],[127,2,135,2],[127,4,129,4],[133,4,134,4],[133,5,134,5],[134,3,135,3]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["11.1 Implement processes to test for the \npresence of wireless access points \n(802.11), and detect and identify all \nauthorized and unauthorized wireless \naccess points on a quarterly basis. \n\nNote: Methods that may be used in the \nprocess include but are not limited to \nwireless network scans, physical/logical \ninspections of system components and \ninfrastructure, network access control \n(NAC), or wireless IDS/IPS. \n\nWhichever methods are used, they must be \nsufficient to detect and identify both \nauthorized and unauthorized devices. ","11.1.a Examine policies and procedures to verify processes are defined for detection and identification of both authorized and unauthorized wireless access points on a quarterly basis. \n\n11.1.b Verify that the methodology is adequate to detect and identify any unauthorized wireless access points, including at least the following: \n\n. WLAN cards inserted into system components \n. Portable or mobile devices attached to system components to create a wireless access point (for example, by USB, etc.) \n. Wireless devices attached to a network port or network device. \n\n11.1.c Examine output from recent wireless scans to verify that: \n\n. Authorized and unauthorized wireless access points are identified, and \n. The scan is performed at least quarterly for all system components and facilities. \n\n11.1.d If automated monitoring is utilized (for example, wireless IDS/IPS, NAC, etc.), verify the configuration will generate alerts to notify personnel. ","Implementation and/or exploitation of wireless technology within a network are some of the most common paths for malicious users to gain access to the network and cardholder data. If a wireless \ndevice or network is installed without a company’s knowledge, it can allow an attacker to easily and “invisibly” enter the network. Unauthorized wireless devices may be hidden within or attached to a computer or other system component, or be attached directly to a network port or network device, such as a switch or router. Any such unauthorized device could result in an unauthorized access point into the environment. \n\nKnowing which wireless devices are authorized can help administrators quickly identify non-authorized wireless devices, and responding to the identification of unauthorized wireless access points helps to proactively minimize the exposure of CDE to malicious individuals. \n\nDue to the ease with which a wireless access point can be attached to a network, the difficulty in detecting their presence, and the increased risk presented by unauthorized wireless devices, these processes must be performed even when a policy exists prohibiting the use of wireless technology. \n\nThe size and complexity of a particular environment will dictate the appropriate tools and processes to be used to provide sufficient assurance that a rogue wireless access point has not been installed in the environment. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.1.1 Maintain an inventory of \nauthorized wireless access points including a documented business justification. ","11.1.1 Examine documented records to verify that an inventory of authorized wireless access points is maintained and a business justification is documented for all authorized \nwireless access points. ","For example: In the case of a single standalone retail kiosk in a shopping mall, where all communication components are contained within \ntamper-resistant and tamper-evident casings, performing a detailed physical inspection of the kiosk itself may be sufficient to provide assurance that a rogue wireless access point has not been attached or installed. However, in an environment with multiple nodes (such as in a large retail store, call center, server room or data center), detailed physical inspection is difficult. In this case, multiple methods may be combined to meet the requirement, such as performing physical system \ninspections in conjunction with the results of a wireless analyzer. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.1.2 Implement incident response \nprocedures in the event unauthorized \nwireless access points are detected. ","11.1.2.a Examine the organization’s incident response plan (Requirement 12.10) to verify it defines and requires a response in the event that an unauthorized wireless access point is detected. \n\n11.1.2.b Interview responsible personnel and/or inspect recent wireless scans and related responses to verify action is taken when unauthorized wireless access points are \nfound. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.1.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.2 Run internal and external network \nvulnerability scans at least quarterly and \nafter any significant change in the network (such as new system component \ninstallations, changes in network topology, firewall rule modifications, product upgrades). \n\nNote: Multiple scan reports can be \ncombined for the quarterly scan process to show that all systems were scanned and all applicable vulnerabilities have been addressed. Additional documentation may be required to verify non-remediated vulnerabilities are in the process of being addressed. \n\nFor initial PCI DSS compliance, it is not \nrequired that four quarters of passing scans be completed if the assessor verifies 1) the most recent scan result was a passing scan, 2) the entity has documented policies and procedures requiring quarterly scanning, and 3) vulnerabilities noted in the scan results have been corrected as shown in a re-scan(s). For subsequent years after the initial PCI DSS review, four quarters of passing scans must have occurred. ","11.2 Examine scan reports and supporting documentation to verify that internal and external vulnerability scans are performed as follows: ","A vulnerability scan is an automated tool run against external and internal network devices and servers, designed to expose potential vulnerabilities that could be found and exploited by malicious individuals. \n\nThere are three types of vulnerability scanning required for PCI DSS: \n\n. Internal quarterly vulnerability scanning by qualified personnel (use of a PCI SSC Approved Scanning Vendor (ASV) is not required) \n. External quarterly vulnerability scanning, which must be performed by an ASV \n. Internal and external scanning as needed after significant changes \n\n\nOnce these weaknesses are identified, the entity corrects them and repeats the scan until all \nvulnerabilities have been corrected. \n\nIdentifying and addressing vulnerabilities in a timely manner reduces the likelihood of a \nvulnerability being exploited and potential compromise of a system component or cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.2.1 Perform quarterly internal vulnerability scans and rescans as \nneeded, until all “high-risk” vulnerabilities (as identified in Requirement 6.1) are resolved. Scans must be performed by qualified personnel. ","11.2.1.a Review the scan reports and verify that four quarterly internal scans occurred in the most recent 12-month period. \n\n11.2.1.b Review the scan reports and verify that the scan process includes rescans until all “high-risk” vulnerabilities as defined in PCI DSS Requirement 6.1 are resolved.\n\n11.2.1.c Interview personnel to verify that the scan was performed by a qualified internal resource(s) or qualified external third party, and if applicable, organizational \nindependence of the tester exists (not required to be a QSA or ASV). ","An established process for identifying \nvulnerabilities on internal systems requires that vulnerability scans be conducted quarterly. Vulnerabilities posing the greatest risk to the \nenvironment (for example, ranked “High” per Requirement 6.1) should be resolved with the highest priority. \n\nInternal vulnerability scans can be performed by qualified, internal staff that are reasonably independent of the system component(s) being \nscanned (for example, a firewall administrator should not be responsible for scanning the \nfirewall), or an entity may choose to have internal vulnerability scans performed by a firm specializing \nin vulnerability scanning. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.2.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.2.2 Perform quarterly external \nvulnerability scans, via an Approved \nScanning Vendor (ASV) approved by the \nPayment Card Industry Security Standards Council (PCI SSC). Perform rescans as needed, until passing scans are achieved. \n\nNote: Quarterly external vulnerability scans must be performed by an Approved \nScanning Vendor (ASV), approved by the \nPayment Card Industry Security Standards \nCouncil (PCI SSC). \n\nRefer to the ASV Program Guide published \non the PCI SSC website for scan customer \nresponsibilities, scan preparation, etc. ","11.2.2.a Review output from the four most recent quarters of external vulnerability scans and verify that four quarterly external vulnerability scans occurred in the most recent 12-month period. \n\n11.2.2.b Review the results of each quarterly scan and rescan to verify that the ASV Program Guide requirements for a passing scan have been met (for example, no vulnerabilities rated 4.0 or higher by the CVSS, and no \nautomatic failures). \n\n11.2.2.c Review the scan reports to verify that the scans were completed by a PCI SSC Approved Scanning Vendor (ASV). ","As external networks are at greater risk of compromise, quarterly external vulnerability scanning must be performed by a PCI SSC Approved Scanning Vendor (ASV). ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.2.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.2.3 Perform internal and external \nscans, and rescans as needed, after any \nsignificant change. Scans must be \nperformed by qualified personnel. ","11.2.3.a Inspect and correlate change control \ndocumentation and scan reports to verify that system components subject to any significant change were scanned. \n\n11.2.3.b Review scan reports and verify that the scan process includes rescans until: \n\n. For external scans, no vulnerabilities exist that are scored 4.0 or higher by the CVSS. \n. For internal scans, all “high-risk” vulnerabilities as defined in PCI DSS Requirement 6.1 are resolved. \n\n11.2.3.c Validate that the scan was performed by a qualified internal resource(s) or qualified external third party, and if \napplicable, organizational independence of the tester exists (not required to be a QSA or ASV). ","The determination of what constitutes a significant change is highly dependent on the configuration of \na given environment. If an upgrade or modification could allow access to cardholder data or affect the \nsecurity of the cardholder data environment, then it could be considered significant. \n\nScanning an environment after any significant changes are made ensures that changes were completed appropriately such that the security of \nthe environment was not compromised as a result of the change. All system components affected by the change will need to be scanned. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.2.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.3 Implement a methodology for \npenetration testing that includes the \nfollowing: \n\n. Is based on industry-accepted penetration testing approaches (for example, NIST SP800-115) \n. Includes coverage for the entire CDE \nperimeter and critical systems \n. Includes testing from both inside and \noutside the network \n. Includes testing to validate any \nsegmentation and scope-reduction \ncontrols \n. Defines application-layer penetration \ntests to include, at a minimum, the \nvulnerabilities listed in Requirement 6.5 \n. Defines network-layer penetration tests \nto include components that support \nnetwork functions as well as operating \nsystems \n. Includes review and consideration of \nthreats and vulnerabilities experienced \nin the last 12 months \n. Specifies retention of penetration \ntesting results and remediation activities \nresults. \n\n\nNote: This update to Requirement 11.3 is a best practice until June 30, 2015, after \nwhich it becomes a requirement. PCI DSS \nv2.0 requirements for penetration testing \nmust be followed until v3.0 is in place. ","11.3 Examine penetration-testing methodology and interview responsible personnel to verify a methodology is implemented that includes the following: \n\n. Is based on industry-accepted penetration testing approaches (for example, NIST SP800-115) \n. Includes coverage for the entire CDE perimeter and critical systems \n. Testing from both inside and outside the network \n. Includes testing to validate any segmentation and scope-reduction controls \n. Defines application-layer penetration tests to include, at a minimum, the vulnerabilities listed in Requirement 6.5 \n. Defines network-layer penetration tests to include components that support network functions as well as operating systems \n. Includes review and consideration of threats and vulnerabilities experienced in the last 12 months \n. Specifies retention of penetration testing results and remediation activities results. ","The intent of a penetration test is to simulate a real-world attack situation with a goal of identifying how far an attacker would be able to penetrate into an environment. This allows an entity to gain a better understanding of their potential exposure and develop a strategy to defend against attacks. \n\nA penetration test differs from a vulnerability scan, as a penetration test is an active process that may include exploiting identified vulnerabilities. Conducting a vulnerability scan may be one of the first steps a penetration tester will perform in order to plan the testing strategy, although it is not the only step. Even if a vulnerability scan does not detect known vulnerabilities, the penetration tester will often gain enough knowledge about the system to identify possible security gaps. \n\nPenetration testing is generally a highly manual process. While some automated tools may be used, the tester uses their knowledge of systems to penetrate into an environment. Often the tester will chain several types of exploits together with a goal of breaking through layers of defenses. For \nexample, if the tester finds a means to gain access to an application server, they will then use the compromised server as a point to stage a new attack based on the resources the server has access to. In this way, a tester is able to simulate the methods performed by an attacker to identify areas of potential weakness in the environment. \n\nPenetration testing techniques will be different for different organizations, and the type, depth, and complexity of the testing will depend on the specific environment and the organization’s risk assessment. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.3.1 Perform external penetration \ntesting at least annually and after any \nsignificant infrastructure or application \nupgrade or modification (such as an \noperating system upgrade, a sub-network \nadded to the environment, or a web \nserver added to the environment).","11.3.1.a Examine the scope of work and results from the most recent external penetration test to verify that penetration testing is performed as follows: \n\n. Per the defined methodology \n. At least annually \n. After any significant changes to the environment. \n\n11.3.1.b Verify that the test was performed by a qualified internal resource or qualified external third party, and if applicable, organizational independence of the tester exists (not required to be a QSA or ASV). ","Penetration testing conducted on a regular basis and after significant changes to the environment is \na proactive security measure that helps minimize potential access to the CDE by malicious individuals. \n\nThe determination of what constitutes a significant upgrade or modification is highly dependent on the \nconfiguration of a given environment. If an upgrade or modification could allow access to cardholder data or affect the security of the cardholder data environment, then it could be considered significant. Performing penetration tests after network upgrades and modifications provides \nassurance that the controls assumed to be in place are still working effectively after the upgrade or \nmodification. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.3.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.3.2 Perform internal penetration \ntesting at least annually and after any \nsignificant infrastructure or application \nupgrade or modification (such as an \noperating system upgrade, a sub-network \nadded to the environment, or a web \nserver added to the environment). ","11.3.2.a Examine the scope of work and results from the most recent internal penetration test to verify that penetration testing is performed at least annually and after any significant changes to the environment. \n\n. Per the defined methodology \n. At least annually \n. After any significant changes to the environment. \n\n11.3.2.b Verify that the test was performed by a qualified internal resource or qualified external third party, and if applicable, organizational independence of the tester exists (not required to be a QSA or ASV). ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.3.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.3.3 Exploitable vulnerabilities found \nduring penetration testing are corrected \nand testing is repeated to verify the \ncorrections. ","11.3.3 Examine penetration testing results to verify that noted exploitable vulnerabilities were corrected and that repeated testing confirmed the vulnerability was corrected. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.3.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.3.4 If segmentation is used to isolate \nthe CDE from other networks, perform \npenetration tests at least annually and \nafter any changes to segmentation \ncontrols/methods to verify that the \nsegmentation methods are operational \nand effective, and isolate all out-of-scope systems from in-scope systems. ","11.3.4.a Examine segmentation controls and review penetration-testing methodology to verify that penetration-testing procedures are defined to test all segmentation methods to confirm they are operational and effective, and isolate all out-of-scope systems from in-scope systems. \n\n11.3.4.b Examine the results from the most recent penetration test to verify that penetration testing to verify segmentation controls: \n\n. Is performed at least annually and after any changes to segmentation controls/methods. \n. Covers all segmentation controls/methods in use. .\n Verifies that segmentation methods are operational and effective, and isolate all out-of-scope systems from in-scope systems. ","Penetration testing is an important tool to confirm that any segmentation in place to isolate the CDE from other networks is effective. The penetration \ntesting should focus on the segmentation controls, both from outside the entity’s network and from \ninside the network but outside of the CDE, to confirm that they are not able to get through the segmentation controls to access the CDE. For example, network testing and/or scanning for open ports, to verify no connectivity between in-scope and out-of-scope networks. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.3.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.4 Use intrusion-detection and/or \nintrusion-prevention techniques to detect \nand/or prevent intrusions into the network. \nMonitor all traffic at the perimeter of the \ncardholder data environment as well as at \ncritical points in the cardholder data \nenvironment, and alert personnel to \nsuspected compromises. \n\nKeep all intrusion-detection and prevention engines, baselines, and signatures up to \ndate. ","11.4.a Examine system configurations and network diagrams to verify that techniques (such as intrusion-detection systems \nand/or intrusion-prevention systems) are in place to monitor all traffic: \n\n. At the perimeter of the cardholder data environment \n. At critical points in the cardholder data environment. \n\n11.4.b Examine system configurations and interview responsible personnel to confirm intrusion-detection and/or intrusion-prevention techniques alert personnel of suspected compromises. \n\n11.4.c Examine IDS/IPS configurations and vendor documentation to verify intrusion-detection and/or intrusion-prevention techniques are configured, maintained, and \nupdated per vendor instructions to ensure optimal protection. ","Intrusion detection and/or intrusion prevention techniques (such as IDS/IPS) compare the traffic \ncoming into the network with known “signatures” and/or behaviors of thousands of compromise types (hacker tools, Trojans, and other malware), and send alerts and/or stop the attempt as it happens. Without a proactive approach to unauthorized activity detection, attacks on (or \nmisuse of) computer resources could go unnoticed in real time. Security alerts generated by these techniques should be monitored so that the \nattempted intrusions can be stopped.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.5 Deploy a change-detection mechanism (for example, file-integrity monitoring tools) to alert personnel to unauthorized modification of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly. \n\nNote: For change-detection purposes, \ncritical files are usually those that do not \nregularly change, but the modification of \nwhich could indicate a system compromise or risk of compromise. Change-detection mechanisms such as file-integrity monitoring products usually come pre-configured with critical files for the related operating system. Other critical files, such as those for custom applications, must be evaluated and defined by the entity (that is, the merchant or service provider). ","11.5.a Verify the use of a change-detection mechanism within the cardholder data environment by observing system settings \nand monitored files, as well as reviewing results from monitoring activities. \n\nExamples of files that should be monitored: \n\n. System executables \n. Application executables \n. Configuration and parameter files \n. Centrally stored, historical or archived, log and audit files \n. Additional critical files determined by entity (for example, through risk assessment or other means). \n\n11.5.b Verify the mechanism is configured to alert personnel to unauthorized modification of critical files, and to perform critical file comparisons at least weekly. ","Change-detection solutions such as file-integrity monitoring (FIM) tools check for changes to critical files, and notify when such changes are detected. If not implemented properly and the output of the change-detection solution monitored, a malicious individual could alter configuration file contents, \noperating system programs, or application executables. Unauthorized changes, if undetected, \ncould render existing security controls ineffective and/or result in cardholder data being stolen with no perceptible impact to normal processing. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.5.1 Implement a process to respond to \nany alerts generated by the change-\ndetection solution. ","11.5.1 Interview personnel to verify that all alerts are investigated and resolved. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.5.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["11.6 Ensure that security policies and \noperational procedures for security \nmonitoring and testing are documented, in \nuse, and known to all affected parties.","11.6 Examine documentation interview personnel to verify that security policies and operational procedures for security monitoring and testing are: \n\n. Documented, \n. In use, and \n. Known to all affected parties. ","Personnel need to be aware of and following security policies and operational procedures for security monitoring and testing on a continuous basis. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"11.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"12","index":12,"n_rows":352,"n_cols":6,"rows_kept":352,"cut":false,"hidden":false,"merged":[[343,0,351,0],[343,1,351,1],[343,2,351,2],[343,4,345,4],[349,4,350,4],[349,5,350,5],[350,3,351,3],[325,0,333,0],[325,1,333,1],[325,2,333,2],[325,4,327,4],[331,4,332,4],[331,5,332,5],[332,3,333,3],[334,0,342,0],[334,1,342,1],[334,2,342,2],[334,4,336,4],[340,4,341,4],[340,5,341,5],[341,3,342,3],[307,0,315,0],[307,1,315,1],[307,2,315,2],[307,4,309,4],[313,4,314,4],[313,5,314,5],[314,3,315,3],[316,0,324,0],[316,1,324,1],[316,2,324,2],[316,4,318,4],[322,4,323,4],[322,5,323,5],[323,3,324,3],[289,0,297,0],[289,1,297,1],[289,2,297,2],[289,4,291,4],[295,4,296,4],[295,5,296,5],[296,3,297,3],[298,0,306,0],[298,1,306,1],[298,2,306,2],[298,4,300,4],[304,4,305,4],[304,5,305,5],[305,3,306,3],[271,0,279,0],[271,1,279,1],[271,2,279,2],[271,4,273,4],[277,4,278,4],[277,5,278,5],[278,3,279,3],[280,0,288,0],[280,1,288,1],[280,2,288,2],[280,4,282,4],[286,4,287,4],[286,5,287,5],[287,3,288,3],[253,0,261,0],[253,1,261,1],[253,2,261,2],[253,4,255,4],[259,4,260,4],[259,5,260,5],[260,3,261,3],[262,0,270,0],[262,1,270,1],[262,2,270,2],[262,4,264,4],[268,4,269,4],[268,5,269,5],[269,3,270,3],[235,0,243,0],[235,1,243,1],[235,2,243,2],[235,4,237,4],[241,4,242,4],[241,5,242,5],[242,3,243,3],[244,0,252,0],[244,1,252,1],[244,2,252,2],[244,4,246,4],[250,4,251,4],[250,5,251,5],[251,3,252,3],[217,0,225,0],[217,1,225,1],[217,2,225,2],[217,4,219,4],[223,4,224,4],[223,5,224,5],[224,3,225,3],[226,0,234,0],[226,1,234,1],[226,2,234,2],[226,4,228,4],[232,4,233,4],[232,5,233,5],[233,3,234,3],[199,0,207,0],[199,1,207,1],[199,2,207,2],[199,4,201,4],[205,4,206,4],[205,5,206,5],[206,3,207,3],[208,0,216,0],[208,1,216,1],[208,2,216,2],[208,4,210,4],[214,4,215,4],[214,5,215,5],[215,3,216,3],[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[16,5,17,5],[17,3,18,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4],[7,5,8,5],[8,3,9,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[34,5,35,5],[35,3,36,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[25,5,26,5],[26,3,27,3],[46,0,54,0],[46,1,54,1],[46,2,54,2],[46,4,48,4],[52,4,53,4],[52,5,53,5],[53,3,54,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[43,5,44,5],[44,3,45,3],[64,0,72,0],[64,1,72,1],[64,2,72,2],[64,4,66,4],[70,4,71,4],[70,5,71,5],[71,3,72,3],[55,0,63,0],[55,1,63,1],[55,2,63,2],[55,4,57,4],[61,4,62,4],[61,5,62,5],[62,3,63,3],[82,0,90,0],[82,1,90,1],[82,2,90,2],[82,4,84,4],[88,4,89,4],[88,5,89,5],[89,3,90,3],[73,0,81,0],[73,1,81,1],[73,2,81,2],[73,4,75,4],[79,4,80,4],[79,5,80,5],[80,3,81,3],[100,0,108,0],[100,1,108,1],[100,2,108,2],[100,4,102,4],[106,4,107,4],[106,5,107,5],[107,3,108,3],[91,0,99,0],[91,1,99,1],[91,2,99,2],[91,4,93,4],[97,4,98,4],[97,5,98,5],[98,3,99,3],[118,0,126,0],[118,1,126,1],[118,2,126,2],[118,4,120,4],[124,4,125,4],[124,5,125,5],[125,3,126,3],[109,0,117,0],[109,1,117,1],[109,2,117,2],[109,4,111,4],[115,4,116,4],[115,5,116,5],[116,3,117,3],[136,0,144,0],[136,1,144,1],[136,2,144,2],[136,4,138,4],[142,4,143,4],[142,5,143,5],[143,3,144,3],[127,0,135,0],[127,1,135,1],[127,2,135,2],[127,4,129,4],[133,4,134,4],[133,5,134,5],[134,3,135,3],[154,0,162,0],[154,1,162,1],[154,2,162,2],[154,4,156,4],[160,4,161,4],[160,5,161,5],[161,3,162,3],[145,0,153,0],[145,1,153,1],[145,2,153,2],[145,4,147,4],[151,4,152,4],[151,5,152,5],[152,3,153,3],[172,0,180,0],[172,1,180,1],[172,2,180,2],[172,4,174,4],[178,4,179,4],[178,5,179,5],[179,3,180,3],[163,0,171,0],[163,1,171,1],[163,2,171,2],[163,4,165,4],[169,4,170,4],[169,5,170,5],[170,3,171,3],[190,0,198,0],[190,1,198,1],[190,2,198,2],[190,4,192,4],[196,4,197,4],[196,5,197,5],[197,3,198,3],[181,0,189,0],[181,1,189,1],[181,2,189,2],[181,4,183,4],[187,4,188,4],[187,5,188,5],[188,3,189,3]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["12.1 Establish, publish, maintain, and \ndisseminate a security policy.","12.1 Examine the information security policy and verify that the policy is published and disseminated to all relevant personnel \n(including vendors and business partners). ","A company's information security policy creates the roadmap for implementing security measures \nto protect its most valuable assets. All personnel should be aware of the sensitivity of data and their \nresponsibilities for protecting it. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.1.1 Review the security policy at least \nannually and update the policy when the \nenvironment changes. ","12.1.1 Verify that the information security policy is reviewed at least annually and updated as needed to reflect changes \nto business objectives or the risk environment. ","Security threats and protection methods evolve rapidly. Without updating the security policy to \nreflect relevant changes, new protection measures to fight against these threats are not addressed. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.2 Implement a risk-assessment process that: \n\n. Is performed at least annually and \nupon significant changes to the \nenvironment (for example, acquisition, \nmerger, relocation, etc.), \n. Identifies critical assets, threats, and \nvulnerabilities, and \n. Results in a formal risk assessment. \n\nExamples of risk-assessment methodologies include but are not limited \nto OCTAVE, ISO 27005 and NIST SP 800-30. ","12.2.a Verify that an annual risk-assessment process is documented that identifies assets, threats, vulnerabilities, and results in a formal risk assessment. \n\n12.2.b Review risk-assessment documentation to verify that the risk-assessment process is performed at least annually and upon significant changes to the environment. ","A risk assessment enables an organization to identify threats and associated vulnerabilities with \nthe potential to negatively impact their business. Resources can then be effectively allocated to implement controls that reduce the likelihood \nand/or the potential impact of the threat being realized. \n\nPerforming risk assessments at least annually and upon significant changes allows the organization \nto keep up to date with organizational changes and evolving threats, trends, and technologies. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3 Develop usage policies for critical \ntechnologies and define proper use of \nthese technologies. \n\nNote: Examples of critical technologies \ninclude, but are not limited to, remote \naccess and wireless technologies, laptops, tablets, removable electronic media, e-mail usage and Internet usage. \n\nEnsure these usage policies require the \nfollowing: ","12.3 Examine the usage policies for critical technologies and interview responsible personnel to verify the following policies \nare implemented and followed: \n","Personnel usage policies can either prohibit use of certain devices and other technologies if that is company policy, or provide guidance for personnel as to correct usage and \nimplementation. If usage policies are not in place, personnel may use the technologies in violation of company policy, thereby allowing malicious individuals to gain access to critical systems and cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.1 Explicit approval by authorized \nparties ","12.3.1 Verify that the usage policies include processes for explicit approval from authorized parties to use the technologies. ","Without requiring proper approval for \nimplementation of these technologies, individual personnel may innocently implement a solution to a perceived business need, but also open a huge hole that subjects critical systems and data to malicious individuals.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.2 Authentication for use of the \ntechnology ","12.3.2 Verify that the usage policies include processes for all technology use to be authenticated with user ID and password or other authentication item (for example, token). ","If technology is implemented without proper authentication (user IDs and passwords, tokens, VPNs, etc.), malicious individuals may easily use \nthis unprotected technology to access critical systems and cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D49,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.3 A list of all such devices and \npersonnel with access ","12.3.3 Verify that the usage policies define a list of all devices and personnel authorized to use the devices. ","Malicious individuals may breach physical security and place their own devices on the network as a “back door.” Personnel may also bypass \nprocedures and install devices. An accurate inventory with proper device labeling allows for quick identification of non-approved installations. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D58,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.4 A method to accurately and \nreadily determine owner, contact \ninformation, and purpose (for example, \nlabeling, coding, and/or inventorying of \ndevices) ","12.3.4 Verify that the usage policies define a method to accurately and readily determine owner, contact information, and purpose (for example, labeling, coding, and/or inventorying of devices). \n","Malicious individuals may breach physical security and place their own devices on the network as a “back door.” Personnel may also bypass \nprocedures and install devices. An accurate inventory with proper device labeling allows for quick identification of non-approved installations. Consider establishing an official naming convention for devices, and log all devices with \nestablished inventory controls. Logical labeling may be employed with information such as codes that can correlate the device to its owner, contact information, and purpose. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D67,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.5 Acceptable uses of the technology ","12.3.5 Verify that the usage policies define acceptable uses for the technology.","By defining acceptable business use and location of company-approved devices and technology, the company is better able to manage and control \ngaps in configurations and perational controls, to ensure a “back door” is not opened for a malicious individual to gain access to critical systems and \ncardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D76,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.6 Acceptable network locations for \nthe technologies ","12.3.6 Verify that the usage policies define acceptable network locations for the technology.",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D85,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.7 List of company-approved products ","12.3.7 Verify that the usage policies include a list of company-approved products. \n",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D94,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.8 Automatic disconnect of sessions \nfor remote-access technologies after a \nspecific period of inactivity ","12.3.8.a Verify that the usage policies require automatic disconnect of sessions for remote-access technologies after a specific period of inactivity. \n\n12.3.8.b Examine configurations for remote access technologies to verify that remote access sessions will be automatically disconnected after a specific period of \ninactivity. ","Remote-access technologies are frequent \"back doors\" to critical resources and cardholder data. \nBy disconnecting remote-access technologies when not in use (for example, those used to support your systems by your POS vendor, other \nvendors, or business partners), access and risk to networks is minimized. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.8","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D103,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.9 Activation of remote-access \ntechnologies for vendors and business \npartners only when needed by vendors \nand business partners, with immediate \ndeactivation after use ","12.3.9 Verify that the usage policies require activation of remote-access technologies used by vendors and business partners only when needed by vendors and business partners, with immediate deactivation after use. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.9","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D112,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.3.10 For personnel accessing cardholder data via remote-access \ntechnologies, prohibit the copying, \nmoving, and storage of cardholder data \nonto local hard drives and removable \nelectronic media, unless explicitly \nauthorized for a defined business need. \n\nWhere there is an authorized business \nneed, the usage policies must require \nthe data be protected in accordance with \nall applicable PCI DSS Requirements. ","12.3.10.a Verify that the usage policies prohibit copying, moving, or storing of cardholder data onto local hard drives \nand removable electronic media when accessing such data via remote-access technologies. \n\n12.3.10.b For personnel with proper authorization, verify that usage policies require the protection of cardholder data in \naccordance with PCI DSS Requirements. \n\n","To ensure all personnel are aware of their responsibilities to not store or copy cardholder data onto their local personal computers or other media, your policy should clearly prohibit such activities except for personnel that have been explicitly authorized to do so. Storing or copying cardholder data onto a local hard drive or other \nmedia must be in accordance with all applicable PCI DSS requirements. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.3.10","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D121,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.4 Ensure that the security policy and \nprocedures clearly define information \nsecurity responsibilities for all personnel. ","12.4.a Verify that information security policies clearly define information security responsibilities for all personnel. \n\n12.4.b Interview a sample of responsible personnel to verify they understand the security policies. ","Without clearly defined security roles and responsibilities assigned, there could be inconsistent interaction with the security group, leading to unsecured implementation of \ntechnologies or use of outdated or unsecured technologies. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D130,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.5 Assign to an individual or team the \nfollowing information security management responsibilities: ","12.5 Examine information security policies and procedures to verify: \n\n. The formal assignment of information security to a Chief Security Officer or other security-knowledgeable member of management. \n. The following information security responsibilities are specifically and formally assigned: ","Each person or team with responsibilities for information security management should be \nclearly aware of their responsibilities and related tasks, through specific policy. Without this accountability, gaps in processes may open access into critical resources or cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D139,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.5.1 Establish, document, and distribute security policies and procedures. ","12.5.1 Verify that responsibility for establishing, documenting and distributing security policies and procedures is formally \nassigned.",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.5.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D148,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.5.2 Monitor and analyze security \nalerts and information, and distribute to \nappropriate personnel.","12.5.2 Verify that responsibility for monitoring and analyzing security alerts and distributing information to appropriate information security and business unit management \npersonnel is formally assigned. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.5.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D157,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.5.3 Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations. ","12.5.3 Verify that responsibility for establishing, documenting, and distributing security incident response and escalation procedures is formally assigned. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.5.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D166,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.5.4 Administer user accounts, including additions, deletions, and modifications. ","12.5.4 Verify that responsibility for administering (adding, deleting, and modifying) user account and authentication \nmanagement is formally assigned. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.5.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D175,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.5.5 Monitor and control all access to \ndata. ","12.5.5 Verify that responsibility for monitoring and controlling all access to data is formally assigned. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.5.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D184,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.6 Implement a formal security \nawareness program to make all personnel \naware of the importance of cardholder \ndata security. ","12.6.a Review the security awareness program to verify it provides awareness to all personnel about the importance of \ncardholder data security. \n\n12.6.b Examine security awareness program procedures and documentation and perform the following: ","If personnel are not educated about their security responsibilities, security safeguards and processes that have been implemented may become ineffective through errors or intentional actions.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D193,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.6.1 Educate personnel upon hire and \nat least annually. \n\nNote: Methods can vary depending on the \nrole of the personnel and their level of \naccess to the cardholder data. ","12.6.1.a Verify that the security awareness program provides multiple methods of communicating awareness and educating personnel (for example, posters, letters, memos, web-based training, meetings, and promotions). \n\n12.6.1.b Verify that personnel attend security awareness training upon hire and at least annually. \n\n12.6.1.c Interview a sample of personnel to verify they have completed awareness training and are aware of the importance of cardholder data security. ","If the security awareness program does not include periodic refresher sessions, key security processes and procedures may be forgotten or \nbypassed, resulting in exposed critical resources and cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.6.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D202,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.6.2 Require personnel to acknowledge at least annually that they have read and understood the security policy and procedures. ","12.6.2 Verify that the security awareness program requires personnel to acknowledge, in writing or electronically, at least annually, that they have read and understand the \ninformation security policy. ","Requiring an acknowledgement by personnel in writing or electronically helps ensure that they have read and understood the security policies / procedures, and that they have made and will continue to make a commitment to comply with these policies. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.6.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D211,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D211,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.7 Screen potential personnel prior to \nhire to minimize the risk of attacks from \ninternal sources. (Examples of background checks include previous employment history, criminal record, credit history, and reference checks.) \n\nNote: For those potential personnel to be \nhired for certain positions such as store \ncashiers who only have access to one \ncard number at a time when facilitating a \ntransaction, this requirement is a \nrecommendation only. ","12.7 Inquire with Human Resource department management and verify that background checks are conducted (within the constraints of local laws) prior to hire on potential personnel who will have access to cardholder data or the cardholder data \nenvironment. ","Performing thorough background investigations prior to hiring potential personnel who are expected to be given access to cardholder data \nreduces the risk of unauthorized use of PANs and other cardholder data by individuals with questionable or criminal backgrounds. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.7","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D220,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D220,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.8 Maintain and implement policies and \nprocedures to manage service providers \nwith whom cardholder data is shared, or \nthat could affect the security of cardholder \ndata, as follows: ","12.8 Through observation, review of policies and procedures, and review of supporting documentation, verify that processes \nare implemented to manage service providers with whom cardholder data is shared, or that could affect the security of cardholder data (for example, backup tape storage facilities, \nmanaged service providers such as web-hosting companies or security service providers, those that receive data for fraud \nmodeling purposes, etc.), as follows: ","If a merchant or service provider shares cardholder data with a service provider, certain requirements apply to ensure continued protection \nof this data will be enforced by such service providers. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.8","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D229,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D229,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.8.1 Maintain a list of service providers. ","12.8.1 Verify that a list of service providers is maintained. ","Keeping track of all service providers identifies where potential risk extends to outside of the organization. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.8.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D238,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D238,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.8.2 Maintain a written agreement that \nincludes an acknowledgement that the \nservice providers are responsible for the \nsecurity of cardholder data the service \nproviders possess or otherwise store, \nprocess or transmit on behalf of the \ncustomer, or to the extent that they \ncould impact the security of the \ncustomer’s cardholder data environment. \n\nNote: The exact wording of an \nacknowledgement will depend on the \nagreement between the two parties, the \ndetails of the service being provided, and \nthe responsibilities assigned to each party. The acknowledgement does not have to include the exact wording provided in this requirement. ","12.8.2 Observe written agreements and confirm they include an acknowledgement by service providers that they are responsible for the security of cardholder data the service \nproviders possess or otherwise store, process or transmit on behalf of the customer, or to the extent that they could impact the security of the customer’s cardholder data environment. ","The acknowledgement of the service providers evidences their commitment to maintaining proper security of cardholder data that it obtains from its clients. \n\nIn conjunction with Requirement 12.9, this requirement for written agreements between organizations and service provides is intended to \npromote a consistent level of understanding between parties about their applicable PCI DSS responsibilities. For example, the agreement may include the applicable PCI DSS requirements to be maintained as part of the provided service. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.8.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D247,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D247,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.8.3 Ensure there is an established \nprocess for engaging service providers \nincluding proper due diligence prior to \nengagement. ","12.8.3 Verify that policies and procedures are documented and implemented including proper due diligence prior to engaging any service provider. ","The process ensures that any engagement of a service provider is thoroughly vetted internally by \nan organization, which should include a risk analysis prior to establishing a formal relationship with the service provider. \n\nSpecific due-diligence processes and goals will vary for each organization. Examples of considerations may include the provider’s reporting practices, breach-notification and \nincident response procedures, details of how PCI DSS responsibilities are assigned between each party, how the provider validates their PCI DSS \ncompliance and what evidence they will provide, etc. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.8.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D256,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D256,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.8.4 Maintain a program to monitor \nservice providers’ PCI DSS compliance \nstatus at least annually. ","12.8.4 Verify that the entity maintains a program to monitor its service providers’ PCI DSS compliance status at least annually. ","Knowing your service providers’ PCI DSS compliance status provides assurance and awareness about whether they comply with the \nsame requirements that your organization is subject to. If the service provider offers a variety \nof services, this requirement should apply to those services delivered to the client, and those services \nin scope for the client’s PCI DSS assessment. \n\nThe specific information an entity maintains will depend on the particular agreement with their \nproviders, the type of service, etc. The intent is for the assessed entity to understand which PCI DSS \nrequirements their providers have agreed to meet. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.8.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D265,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D265,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.8.5 Maintain information about which \nPCI DSS requirements are managed by \neach service provider, and which are \nmanaged by the entity. ","12.8.5 Verify the entity maintains information about which PCI DSS requirements are managed by each service provider, and which are managed by the entity. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.8.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D274,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D274,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.9 Additional requirement for service \nproviders: Service providers acknowledge in writing to customers that they are responsible for the security of \ncardholder data the service provider \npossesses or otherwise stores, processes, \nor transmits on behalf of the customer, or \nto the extent that they could impact the \nsecurity of the customer’s cardholder data \nenvironment. \n\nNote: This requirement is a best practice \nuntil June 30, 2015, after which it becomes a requirement. \n\nNote: The exact wording of an \nacknowledgement will depend on the \nagreement between the two parties, the \ndetails of the service being provided, and \nthe responsibilities assigned to each party. \nThe acknowledgement does not have to \ninclude the exact wording provided in this \nrequirement. ","12.9 Additional testing procedure for service providers: Review service provider’s policies and procedures and observe written agreement templates to confirm the service \nprovider acknowledges in writing to customers that the service provider will maintain all applicable PCI DSS requirements to \nthe extent the service provider handles, has access to, or otherwise stores, processes or transmits the customer’s cardholder data or sensitive authentication data, or manages \nthe customer's cardholder data environment on behalf of a customer. ","This requirement applies when the entity being assessed is a service provider. In conjunction with \nRequirement 12.8.2, this requirement is intended to promote a consistent level of understanding between service providers and their customers \nabout their applicable PCI DSS responsibilities. The acknowledgement of the service providers evidences their commitment to maintaining proper security of cardholder data that it obtains from its clients. \n\nThe method by which the service provider provides written acknowledgment should be \nagreed between the provider and their customers. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.9","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D283,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D283,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.10 Implement an incident response \nplan. Be prepared to respond immediately \nto a system breach. ","12.10 Examine the incident response plan and related procedures to verify entity is prepared to respond immediately to a system breach by performing the following:","Without a thorough security incident response plan that is properly disseminated, read, and understood by the parties responsible, confusion \nand lack of a unified response could create further downtime for the business, unnecessary public media exposure, as well as new legal liabilities. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.10","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D292,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D292,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.10.1 Create the incident response \nplan to be implemented in the event of \nsystem breach. Ensure the plan addresses the following, at a minimum: \n\n. Roles, responsibilities, and communication and contact strategies in the event of a compromise including notification of the payment brands, at a minimum \n. Specific incident response \nprocedures \n. Business recovery and continuity \nprocedures \n. Data backup processes \n. Analysis of legal requirements for \nreporting compromises \n. Coverage and responses of all critical system components \n. Reference or inclusion of incident \nresponse procedures from the payment brands. ","12.10.1.a Verify that the incident response plan includes: \n\n. Roles, responsibilities, and communication strategies in the event of a compromise including notification of the payment brands, at a minimum \n. Specific incident response procedures \n. Business recovery and continuity procedures \n. Data backup processes \n. Analysis of legal requirements for reporting \ncompromises (for example, California Bill 1386, which requires notification of affected consumers in the event of an actual or suspected compromise for any business \nwith California residents in their database) \n. Coverage and responses for all critical system components \n. Reference or inclusion of incident response procedures from the payment brands. \n\n12.10.1.b Interview personnel and review documentation from a sample of previously reported incidents or alerts to verify that the documented incident response plan and \nprocedures were followed. ","The incident response plan should be thorough and contain all the key elements to allow your company to respond effectively in the event of a \nbreach that could impact cardholder data. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.10.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D301,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D301,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.10.2 Test the plan at least annually. ","12.10.2 Verify that the plan is tested at least annually. ","Without proper testing, key steps may be missed, which could result in increased exposure during an incident. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"10.10.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D310,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D310,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.10.3 Designate specific personnel to \nbe available on a 24/7 basis to respond \nto alerts. ","12.10.3 Verify through observation, review of policies, and interviews of responsible personnel that designated personnel are available for 24/7 incident response and \nmonitoring coverage for any evidence of unauthorized activity, detection of unauthorized wireless access points, \ncritical IDS alerts, and/or reports of unauthorized critical system or content file changes. ","Without a trained and readily available incident response team, extended damage to the network \ncould occur, and critical data and systems may become “polluted” by inappropriate handling of the \ntargeted systems. This can hinder the success of a post-incident investigation. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.10.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D319,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D319,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.10.4 Provide appropriate training to \nstaff with security breach response \nresponsibilities. ","12.10.4 Verify through observation, review of policies, and interviews of responsible personnel that staff with responsibilities for security breach response are periodically \ntrained. ",null,null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.10.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D328,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D328,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.10.5 Include alerts from security \nmonitoring systems, including but not \nlimited to intrusion-detection, intrusion-\nprevention, firewalls, and file-integrity \nmonitoring systems. ","12.10.5 Verify through observation and review of processes that monitoring and responding to alerts from security monitoring systems, including detection of unauthorized wireless access points, are covered in the incident response plan. ","These monitoring systems are Designed to focus on potential risk to data, are critical in taking quick \naction to prevent a breach, and must be included in the incident-response processes. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.10.5","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D337,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D337,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["12.10.6 Develop a process to modify \nand evolve the incident response plan \naccording to lessons learned and to \nincorporate industry developments. ","12.10.6 Verify through observation, review of policies, and interviews of responsible personnel that there is a process to modify and evolve the incident response plan according to lessons learned and to incorporate industry developments. ","Incorporating “lessons learned” into the incident response plan after an incident helps keep the plan current and able to react to emerging threats \nand security trends. \n",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"12.10.6","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D346,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D346,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"A.1","index":13,"n_rows":46,"n_cols":6,"rows_kept":46,"cut":false,"hidden":false,"merged":[[43,5,44,5],[44,3,45,3],[28,0,36,0],[28,1,36,1],[28,2,36,2],[28,4,30,4],[34,4,35,4],[34,5,35,5],[35,3,36,3],[37,0,45,0],[37,1,45,1],[37,2,45,2],[37,4,39,4],[43,4,44,4],[25,5,26,5],[26,3,27,3],[10,0,18,0],[10,1,18,1],[10,2,18,2],[10,4,12,4],[16,4,17,4],[16,5,17,5],[17,3,18,3],[19,0,27,0],[19,1,27,1],[19,2,27,2],[19,4,21,4],[25,4,26,4],[7,5,8,5],[8,3,9,3],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,4,3,4],[7,4,8,4]]}
["PCI DSS Requirements","Testing Procedures ","Guidance ",null,"Information to be provided by your organisation"]
["A.1 Protect each entity’s (that is, \nmerchant, service provider, or other \nentity) hosted environment and data, per \nA.1.1 through A.1.4: \n\nA hosting provider must fulfill these \nrequirements as well as all other relevant \nsections of the PCI DSS. \n\nNote: Even though a hosting provider \nmay meet these requirements, the \ncompliance of the entity that uses the \nhosting provider is not guaranteed. Each \nentity must comply with the PCI DSS and \nvalidate compliance as applicable. ","A.1 Specifically for a PCI DSS assessment of a shared hosting provider, to verify that shared hosting providers protect entities’ \n(merchants and service providers) hosted environment and data, select a sample of servers (Microsoft Windows and Unix/Linux) \nacross a representative sample of hosted merchants and service providers, and perform A.1.1 through A.1.4 below: ","Appendix A of PCI DSS is intended for \nshared hosting providers who wish to \nprovide their merchant and/or service \nprovider customers with a PCI DSS \ncompliant hosting environment.",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"A.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D4,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["A.1.1 Ensure that each entity only runs \nprocesses that have access to that \nentity’s cardholder data environment. ","A.1.1 If a shared hosting provider allows entities (for example, merchants or service providers) to run their own applications, verify \nthese application processes run using the unique ID of the entity. \nFor example: \n\n. No entity on the system can use a shared web server user ID. \n. All CGI scripts used by an entity must be created and run as the entity’s unique user ID. ","If a merchant or service provider is \nallowed to run their own applications on the shared server, these should run with the user ID of the merchant or service provider, rather than as a privileged user. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"A.1.1","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D13,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["A.1.2 Restrict each entity’s access and \nprivileges to its own cardholder data \nenvironment only. ","A.1.2.a Verify the user ID of any application process is not a privileged user (root/admin). \n\nA.1.2.b Verify each entity (merchant, service provider) has read, write, or execute permissions only for files and directories it owns or for necessary system files (restricted via file system permissions, access control lists, chroot, jailshell, etc.) \n\nImportant: An entity’s files may not be shared by group. \n\nA.1.2.c Verify that an entity’s users do not have write access to shared system binaries. \n\nA.1.2.d Verify that viewing of log entries is restricted to the owning entity. \n\nA.1.2.e To ensure each entity cannot monopolize server resources to exploit vulnerabilities (for example, error, race, and restart conditions resulting in, for example, buffer overflows), verify restrictions are in place for the use of these system resources: \n\n. Disk space \n. Bandwidth \n. Memory \n. CPU ","To ensure that access and privileges are restricted such that each merchant or service provider has access only to their own environment, consider the following: \n\n1. Privileges of the merchant’s or service provider’s web server user ID; \n2. Permissions granted to read, write, \nand execute files; \n3. Permissions granted to write to system binaries; \n4. Permissions granted to merchant’s \nand service provider’s log files; and \n5. Controls to ensure one merchant or \nservice provider cannot monopolize \nsystem resources. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"A.1.2","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D22,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["A.1.3 Ensure logging and audit trails are enabled and unique to each entity’s \ncardholder data environment and consistent with PCI DSS Requirement 10. \n","A.1.3 Verify the shared hosting provider has enabled logging as follows, for each merchant and service provider environment: \n\n. Logs are enabled for common third-party applications. \n. Logs are active by default. \n. Logs are available for review by the owning entity. \n. Log locations are clearly communicated to the owning entity. ","Logs should be available in a shared \nhosting environment so the merchants and service providers have access to, and can review, logs specific to their cardholder data environment. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"A.1.3","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D31,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]
["A.1.4 Enable processes to provide for \ntimely forensic investigation in the \nevent of a compromise to any hosted \nmerchant or service provider. ","A.1.4 Verify the shared hosting provider has written policies that provide for a timely forensics investigation of related servers in the event of a compromise. ","Shared hosting providers must have \nprocesses to provide quick and easy \nresponse in the event that a forensic \ninvestigation is needed for a compromise, down to the appropriate level of detail so that an individual merchant’s or service provider’s details are available. ",null,"Document names\nand chapter \nreferences"]
[null,null,null,"Implementation grade"]
[null,null,null,"Not performed"]
[]
[null,null,null,"A.1.4","Responsible"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK2S:LOK2ST,2,FALSE)","v":0},"Target completion date"]
[null,null,null,"PCI DSS Status","Met by using compensating control","NO"]
[null,null,null,{"$f":"VLOOKUP(D40,[0]!LOK1S:LOK1ST,2,FALSE)","v":"NOT OK"}]
[null,null,null,null,"Comments"]

{"sheet":"Not in place","index":14,"n_rows":1,"n_cols":4,"rows_kept":1,"cut":false,"hidden":false,"merged":[]}
["PCI DSS Requirements","Status","Responsible","Target date"]

{"sheet":"Maturity graphs","index":15,"n_rows":398,"n_cols":23,"rows_kept":398,"cut":false,"hidden":false,"merged":[]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D6","v":"1.1"},{"$f":"'1'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D15","v":"1.1.1"},{"$f":"S1.1.1","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D24","v":"1.1.2"},{"$f":"'1'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D33","v":"1.1.3"},{"$f":"'1'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D42","v":"1.1.4"},{"$f":"'1'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D51","v":"1.1.5"},{"$f":"'1'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D60","v":"1.1.6"},{"$f":"'1'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D69","v":"1.1.7"},{"$f":"'1'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D78","v":"1.2"},{"$f":"'1'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D87","v":"1.2.1"},{"$f":"'1'!D88","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D96","v":"1.2.2"},{"$f":"'1'!D97","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D105","v":"1.2.3"},{"$f":"'1'!D106","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D114","v":"1.3"},{"$f":"'1'!D115","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D123","v":"1.3.1"},{"$f":"'1'!D124","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D132","v":"1.3.2"},{"$f":"'1'!D133","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D141","v":"1.3.3"},{"$f":"'1'!D142","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D150","v":"1.3.4"},{"$f":"'1'!D151","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D159","v":"1.3.5"},{"$f":"'1'!D160","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D168","v":"1.3.6"},{"$f":"'1'!D169","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D177","v":"1.3.7"},{"$f":"'1'!D178","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D186","v":"1.3.8"},{"$f":"'1'!D187","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D195","v":"1.4"},{"$f":"'1'!D196","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'1'!D204","v":"1.5"},{"$f":"'1'!D205","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D6","v":"2.1"},{"$f":"'2'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D15","v":"2.1.1"},{"$f":"'2'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D24","v":"2.2"},{"$f":"'2'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D33","v":"2.21"},{"$f":"'2'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D42","v":"2.2.2"},{"$f":"'2'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D51","v":"2.2.3"},{"$f":"'2'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D60","v":"2.2.4"},{"$f":"'2'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D69","v":"2.2.5"},{"$f":"'2'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D78","v":"2.3"},{"$f":"'2'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D87","v":"2.4"},{"$f":"'2'!D88","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D96","v":"2.5"},{"$f":"'2'!D97","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'2'!D105","v":"2.6"},{"$f":"'2'!D106","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D6","v":"3.1"},{"$f":"'3'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D15","v":"3.2"},{"$f":"'3'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D24","v":"3.2.1"},{"$f":"'3'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D33","v":"3.2.2"},{"$f":"'3'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D42","v":"3.2.3"},{"$f":"'3'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D51","v":"3.3"},{"$f":"'3'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D60","v":"3.4"},{"$f":"'3'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D69","v":"3.4.1"},{"$f":"'3'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D78","v":"3.5"},{"$f":"'3'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D87","v":"3.5.1"},{"$f":"'3'!D88","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D96","v":"3.5.2"},{"$f":"'3'!D97","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D105","v":"3.5.3"},{"$f":"'3'!D106","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D114","v":"3.6"},{"$f":"'3'!D115","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D123","v":"3.6.1"},{"$f":"'3'!D124","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D132","v":"3.6.2"},{"$f":"'3'!D133","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D141","v":"3.6.3"},{"$f":"'3'!D142","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D150","v":"3.6.4"},{"$f":"'3'!D151","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D159","v":"3.6.5"},{"$f":"'3'!D160","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D168","v":"3.6.6"},{"$f":"'3'!D169","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D177","v":"3.6.7"},{"$f":"'3'!D178","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D186","v":"3.6.8"},{"$f":"'3'!D187","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'3'!D195","v":"3.7"},{"$f":"'3'!D196","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'4'!D6","v":"4.1"},{"$f":"'4'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'4'!D15","v":"4.1.1"},{"$f":"'4'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'4'!D24","v":"4.2"},{"$f":"'4'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'4'!D33","v":"4.3"},{"$f":"'4'!D34","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'5'!D6","v":"5.1"},{"$f":"'5'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'5'!D15","v":"5.1.1"},{"$f":"'5'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'5'!D24","v":"5.1.2"},{"$f":"'5'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'5'!D33","v":"5.2"},{"$f":"'5'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'5'!D42","v":"5.3"},{"$f":"'5'!D43","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D6","v":"6.1"},{"$f":"'6'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D15","v":"6.2"},{"$f":"'6'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D24","v":"6.3"},{"$f":"'6'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D33","v":"6.3.1"},{"$f":"'6'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D42","v":"6.3.2"},{"$f":"'6'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D51","v":"6.4"},{"$f":"'6'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D60","v":"6.4.1"},{"$f":"'6'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D69","v":"6.4.2"},{"$f":"'6'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D78","v":"6.4.3"},{"$f":"'6'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D87","v":"6.4.4"},{"$f":"'6'!D88","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D96","v":"6.4.5"},{"$f":"'6'!D97","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D105","v":"6.4.5.1"},{"$f":"'6'!D106","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D114","v":"6.4.5.2"},{"$f":"'6'!D115","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D123","v":"6.4.5.3"},{"$f":"'6'!D124","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D132","v":"6.4.5.4"},{"$f":"'6'!D133","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D141","v":"6.5"},{"$f":"'6'!D142","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D150","v":"6.5.1"},{"$f":"'6'!D151","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D159","v":"6.5.2"},{"$f":"'6'!D160","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D168","v":"6.5.3"},{"$f":"'6'!D169","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D177","v":"6.5.4"},{"$f":"'6'!D178","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D186","v":"6.5.5"},{"$f":"'6'!D187","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D195","v":"6.5.6"},{"$f":"'6'!D196","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D204","v":"6.5.7"},{"$f":"'6'!D205","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D213","v":"6.5.8"},{"$f":"'6'!D214","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D222","v":"6.5.9"},{"$f":"'6'!D223","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D231","v":"6.5.10"},{"$f":"'6'!D232","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D240","v":"6.6"},{"$f":"'6'!D241","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'6'!D249","v":"6.7"},{"$f":"'6'!D250","v":0}]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D6","v":"7.1"},{"$f":"'7'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D15","v":"7.1.1"},{"$f":"'7'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D24","v":"7.1.2"},{"$f":"'7'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D33","v":"7.1.3"},{"$f":"'7'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D42","v":"7.1.4"},{"$f":"'7'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D51","v":"7.2"},{"$f":"'7'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D60","v":"7.2.1"},{"$f":"'7'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D69","v":"7.2.2"},{"$f":"'7'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D78","v":"7.2.3"},{"$f":"'7'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'7'!D87","v":"7.3"},{"$f":"'7'!D88","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D6","v":"8.1"},{"$f":"'8'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D15","v":"8.1.1"},{"$f":"'8'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D24","v":"8.1.2"},{"$f":"'8'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D33","v":"8.1.3"},{"$f":"'8'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D42","v":"8.1.4"},{"$f":"'8'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D51","v":"8.1.5"},{"$f":"'8'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D60","v":"8.1.6"},{"$f":"'8'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D69","v":"8.1.7"},{"$f":"'8'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D78","v":"8.1.8"},{"$f":"'8'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D87","v":"8.2"},{"$f":"'8'!D88","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D96","v":"8.2.1"},{"$f":"'8'!D97","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D105","v":"8.2.2"},{"$f":"'8'!D106","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D114","v":"8.2.3"},{"$f":"'8'!D115","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D123","v":"8.2.4"},{"$f":"'8'!D124","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D132","v":"8.2.5"},{"$f":"'8'!D133","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D141","v":"8.2.6"},{"$f":"'8'!D142","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D150","v":"8.3"},{"$f":"'8'!D151","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D159","v":"8.4"},{"$f":"'8'!D160","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D168","v":"8.5"},{"$f":"'8'!D169","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D177","v":"8.5.1"},{"$f":"'8'!D178","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D186","v":"8.6"},{"$f":"'8'!D187","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D195","v":"8.7"},{"$f":"'8'!D196","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'8'!D204","v":"8.8"},{"$f":"'8'!D205","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D6","v":"9.1"},{"$f":"'9'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D15","v":"9.1.1"},{"$f":"'9'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D24","v":"9.1.2"},{"$f":"'9'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D33","v":"9.1.3"},{"$f":"'9'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D42","v":"9.2"},{"$f":"'9'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D51","v":"9.3"},{"$f":"'9'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D60","v":"9.4"},{"$f":"'9'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D69","v":"9.4.1"},{"$f":"'9'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D78","v":"9.4.2"},{"$f":"'9'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D87","v":"9.4.3"},{"$f":"'9'!D88","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D96","v":"9.4.4"},{"$f":"'9'!D97","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D105","v":"9.5"},{"$f":"'9'!D106","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D114","v":"9.5.1"},{"$f":"'9'!D115","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D123","v":"9.6"},{"$f":"'9'!D124","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D132","v":"9.6.1"},{"$f":"'9'!D133","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D141","v":"9.6.2"},{"$f":"'9'!D142","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D150","v":"9.6.3"},{"$f":"'9'!D151","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D159","v":"9.7"},{"$f":"'9'!D160","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D168","v":"9.7.1"},{"$f":"'9'!D169","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D177","v":"9.8"},{"$f":"'9'!D178","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D186","v":"9.8.1"},{"$f":"'9'!D187","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D195","v":"9.8.2"},{"$f":"'9'!D196","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D204","v":"9.9"},{"$f":"'9'!D205","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D213","v":"9.9.1"},{"$f":"'9'!D214","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D222","v":"9.9.2"},{"$f":"'9'!D223","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D231","v":"9.9.3"},{"$f":"'9'!D232","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'9'!D240","v":"9.10"},{"$f":"'9'!D241","v":0}]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D6","v":"10.1"},{"$f":"'10'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D15","v":"10.2"},{"$f":"'10'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D24","v":"10.2.1"},{"$f":"'10'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D33","v":"10.2.2"},{"$f":"'10'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D42","v":"10.2.3"},{"$f":"'10'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D51","v":"10.2.4"},{"$f":"'10'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D60","v":"10.2.5"},{"$f":"'10'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D69","v":"10.2.6"},{"$f":"'10'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D78","v":"10.2.7"},{"$f":"'10'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D87","v":"10.3"},{"$f":"'10'!D88","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D96","v":"10.3.1"},{"$f":"'10'!D97","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D105","v":"10.3.2"},{"$f":"'10'!D106","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D114","v":"10.3.3"},{"$f":"'10'!D113","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D123","v":"10.3.4"},{"$f":"'10'!D124","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D132","v":"10.3.5"},{"$f":"'10'!D133","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D141","v":"10.3.6"},{"$f":"'10'!D142","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D150","v":"10.4"},{"$f":"'10'!D151","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D159","v":"10.4.1"},{"$f":"'10'!D160","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D168","v":"10.4.2"},{"$f":"'10'!D169","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D177","v":"10.4.3"},{"$f":"'10'!D178","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D186","v":"10.5"},{"$f":"'10'!D187","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D195","v":"10.5.1"},{"$f":"'10'!D196","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D204","v":"10.5.2"},{"$f":"'10'!D205","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D213","v":"10.5.3"},{"$f":"'10'!D214","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D222","v":"10.5.4"},{"$f":"'10'!D223","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D231","v":"10.5.5"},{"$f":"'10'!D232","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D240","v":"10.6"},{"$f":"'10'!D241","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D249","v":"10.6.1"},{"$f":"'10'!D250","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D258","v":"10.6.2"},{"$f":"'10'!D259","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D267","v":"10.6.3"},{"$f":"'10'!D268","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D276","v":"10.7"},{"$f":"'10'!D277","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'10'!D285","v":"10.8"},{"$f":"'10'!D286","v":0}]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D6","v":"11.1"},{"$f":"'11'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D15","v":"11.1.1"},{"$f":"'11'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D24","v":"11.1.2"},{"$f":"'11'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D33","v":"11.2"},{"$f":"'11'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D42","v":"11.2.1"},{"$f":"'11'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D51","v":"11.2.2"},{"$f":"'11'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D60","v":"11.2.3"},{"$f":"'11'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D69","v":"11.3"},{"$f":"'11'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D78","v":"11.3.1"},{"$f":"'11'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D87","v":"11.3.2"},{"$f":"'11'!D88","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D96","v":"11.3.3"},{"$f":"'11'!D97","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D105","v":"11.3.4"},{"$f":"'11'!D106","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D114","v":"11.4"},{"$f":"'11'!D115","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D123","v":"11.5"},{"$f":"'11'!D124","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D132","v":"11.5.1"},{"$f":"'11'!D133","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'11'!D141","v":"11.6"},{"$f":"'11'!D142","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D6","v":"12.1"},{"$f":"'12'!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D15","v":"12.1.1"},{"$f":"'12'!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D24","v":"12.2"},{"$f":"'12'!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D33","v":"12.3"},{"$f":"'12'!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D42","v":"12.3.1"},{"$f":"'12'!D43","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D51","v":"12.3.2"},{"$f":"'12'!D52","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D60","v":"12.3.3"},{"$f":"'12'!D61","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D69","v":"12.3.4"},{"$f":"'12'!D70","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D78","v":"12.3.5"},{"$f":"'12'!D79","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D87","v":"12.3.6"},{"$f":"'12'!D88","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D96","v":"12.3.7"},{"$f":"'12'!D97","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D105","v":"12.3.8"},{"$f":"'12'!D106","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D114","v":"12.3.9"},{"$f":"'12'!D115","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D123","v":"12.3.10"},{"$f":"'12'!D124","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D132","v":"12.4"},{"$f":"'12'!D133","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D141","v":"12.5"},{"$f":"'12'!D142","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D150","v":"12.5.1"},{"$f":"'12'!D151","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D159","v":"12.5.2"},{"$f":"'12'!D160","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D168","v":"12.5.3"},{"$f":"'12'!D169","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D177","v":"12.5.4"},{"$f":"'12'!D178","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D186","v":"12.5.5"},{"$f":"'12'!D187","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D195","v":"12.6"},{"$f":"'12'!D196","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D204","v":"12.6.1"},{"$f":"'12'!D205","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D213","v":"12.6.2"},{"$f":"'12'!D214","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D222","v":"12.7"},{"$f":"'12'!D223","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D321","v":"12.10.3"},{"$f":"'12'!D322","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D330","v":"12.10.4"},{"$f":"'12'!D331","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D339","v":"12.10.5"},{"$f":"'12'!D340","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'12'!D348","v":"12.10.6"},{"$f":"'12'!D349","v":0}]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"A.1!D6","v":"A.1"},{"$f":"A.1!D7","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"A.1!D15","v":"A.1.1"},{"$f":"A.1!D16","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"A.1!D24","v":"A.1.2"},{"$f":"A.1!D25","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"A.1!D33","v":"A.1.3"},{"$f":"A.1!D34","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"A.1!D42","v":"A.1.4"},{"$f":"A.1!D43","v":0}]

{"sheet":"CCWs","index":16,"n_rows":1,"n_cols":1,"rows_kept":1,"cut":false,"hidden":false,"merged":[]}
["PCI DSS Requirements"]

{"sheet":"CCW Template","index":17,"n_rows":10,"n_cols":3,"rows_kept":10,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Requirement Number and Definition:"]
[]
[null,"Information Required","Explanation"]
["1. Constraints","List constraints precluding compliance with the original requirement."]
["2. Objective","Define the objective of the original control; identify the objective met by the compensating control."]
["3. Identified Risk","Identify any additional risk posed by the lack of the original control."]
["4. Definition of Compensating Controls","Define the compensating controls and explain how they address the objectives of the original control and the increased risk, if any."]
["5. Validation of Compensating Controls","Define how the compensating controls were validated and tested."]
["6. Maintenance","Define process and controls in place to maintain compensating controls."]

{"sheet":"Sample CHD Flow","index":18,"n_rows":27,"n_cols":14,"rows_kept":27,"cut":false,"hidden":false,"merged":[]}
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Cardholder data Flow explanation"]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"The flow starts with customer using their"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"card in the POS Terminal (1), the POS terminal"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"sends the transaction to the transaction switch,"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"using SSL/TLS connection with AES-256 bit encryption."]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"The transaction switch (2) forwards the transaction"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"using SSL/TLS connection with AES-256 bit encryption"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"to the acquring bank (3). No data is stored "]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"during this process. Sensitive auth data is"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"re-encrypted within HSM in transaction server"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"using 3DES with double length keys (112 bits). "]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"When transaction is completed the transaction"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"switch (2) sends Credit Card Number to "]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Loyalty Server (4) which uses SHA-512 to hash"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"the Credit Card Number before storing or"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"processing the Credit Card Number."]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Users (5) connects to both transaction switch(2)"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"and loyalty system using HTTPs with AES-256"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"encryption."]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Administrators on Office network (5) connects"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"to all systems using SSH."]