path: root/data/saq_c.json

{
  "id": "saq_c",
  "name": "SAQ C",
  "version": "PCI DSS v4.0",
  "description": "For merchants whose payment application systems are connected to the Internet, with no electronic cardholder data storage after authorization.",
  "applicability": "This SAQ applies to merchants who process cardholder data only via payment application systems connected to the Internet. The payment application must be isolated in a network segment separate from other systems. No electronic cardholder data storage occurs after authorization.",
  "requirements": [
    {
      "id": "1",
      "title": "Install and Maintain Network Security Controls",
      "objective": "Network security controls protect the environment from unauthorized access.",
      "controls": [
        {
          "id": "1.1",
          "title": "Processes and mechanisms for installing and maintaining network security controls are defined and understood.",
          "items": [
            {
              "id": "1.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 1 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "1.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 1 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "1.2",
          "title": "Network security controls (NSCs) are configured and maintained.",
          "items": [
            {
              "id": "1.2.1",
              "question": "Are configuration standards for all NSC rulesets defined and implemented, denying all traffic by default with only necessary traffic explicitly allowed?",
              "guidance": "Examine configuration standards and NSC configurations."
            },
            {
              "id": "1.2.2",
              "question": "Are all changes to network connections and NSC configurations managed in accordance with the change-control process defined at Requirement 6.5.1?",
              "guidance": "Examine network documentation and change-control records."
            },
            {
              "id": "1.2.3",
              "question": "Is an accurate network diagram(s) maintained that shows all connections between the CDE and other networks, including any wireless networks?",
              "guidance": "Examine network diagrams and interview personnel."
            },
            {
              "id": "1.2.4",
              "question": "Is an accurate data-flow diagram(s) maintained that shows all account data flows across systems and networks and is updated as needed upon changes to the environment?",
              "guidance": "Examine data-flow diagrams and interview personnel."
            },
            {
              "id": "1.2.5",
              "question": "Are all services, protocols, and ports allowed (inbound and outbound) identified, approved, and is there a defined business need for each?",
              "guidance": "Examine NSC configurations and interview personnel."
            },
            {
              "id": "1.2.6",
              "question": "Are security features defined and implemented for all services, protocols, and ports that are in use and considered to be insecure?",
              "guidance": "Examine NSC configuration settings."
            },
            {
              "id": "1.2.7",
              "question": "Are configurations of NSCs reviewed at least once every six months to confirm they remain appropriate and reflect current business needs?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "1.2.8",
              "question": "Are configuration files for NSCs secured from unauthorized access and kept consistent with active network configurations?",
              "guidance": "Examine configuration files for NSCs."
            }
          ]
        },
        {
          "id": "1.3",
          "title": "Network access to and from the cardholder data environment is restricted.",
          "items": [
            {
              "id": "1.3.1",
              "question": "Is inbound traffic to the CDE restricted to only that which is necessary, and is all other traffic denied?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.3.2",
              "question": "Is outbound traffic from the CDE restricted to only that which is necessary, and is all other traffic denied?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.3.3",
              "question": "Are NSCs installed between all wireless networks and the CDE, and do these NSCs deny or control all traffic from wireless environments into the CDE?",
              "guidance": "Examine NSC configurations."
            }
          ]
        },
        {
          "id": "1.4",
          "title": "Network connections between trusted and untrusted networks are controlled.",
          "items": [
            {
              "id": "1.4.1",
              "question": "Are NSCs implemented between trusted and untrusted networks?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.4.2",
              "question": "Does inbound traffic from untrusted networks to trusted networks pass through an NSC that denies all traffic not explicitly allowed?",
              "guidance": "Examine NSC configurations and interview personnel."
            },
            {
              "id": "1.4.3",
              "question": "Are anti-spoofing measures implemented to detect and block forged source IP addresses from entering the trusted network?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.4.4",
              "question": "Are system components that store cardholder data not directly accessible from untrusted networks?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.4.5",
              "question": "Is the disclosure of internal IP addresses and routing information to unauthorized parties limited?",
              "guidance": "Examine NSC configurations."
            }
          ]
        },
        {
          "id": "1.5",
          "title": "Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.",
          "items": [
            {
              "id": "1.5.1",
              "question": "Are security controls implemented on any computing devices that connect to both untrusted networks (including the Internet) and the CDE, with specific configuration settings defined to prevent threats, controls actively running, and controls not alterable by users without documented management authorization?",
              "guidance": "Examine policies and configuration standards and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "2",
      "title": "Apply Secure Configurations to All System Components",
      "objective": "Secure configurations reduce the attack surface available to malicious actors.",
      "controls": [
        {
          "id": "2.1",
          "title": "Processes and mechanisms for applying secure configurations to all system components are defined and understood.",
          "items": [
            {
              "id": "2.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 2 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "2.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 2 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "2.2",
          "title": "System components are configured and managed securely.",
          "items": [
            {
              "id": "2.2.1",
              "question": "Are configuration standards developed, implemented, and maintained for all system components that address all known security vulnerabilities and are consistent with industry-accepted system hardening standards?",
              "guidance": "Examine system configuration standards and interview personnel."
            },
            {
              "id": "2.2.2",
              "question": "Are vendor default accounts managed by changing default passwords if used or removing/disabling accounts if not used?",
              "guidance": "Examine system configuration standards and interview personnel."
            },
            {
              "id": "2.2.3",
              "question": "Is all non-console administrative access encrypted using strong cryptography?",
              "guidance": "Examine system configuration settings and interview personnel."
            },
            {
              "id": "2.2.4",
              "question": "Are only necessary services, protocols, daemons, and functions enabled, and are all unnecessary functionality removed or disabled?",
              "guidance": "Examine system configuration standards and system components."
            },
            {
              "id": "2.2.5",
              "question": "If any insecure services, protocols, or daemons are present, is the business need documented and are additional security features implemented to reduce the risk?",
              "guidance": "Examine system configuration standards."
            },
            {
              "id": "2.2.6",
              "question": "Are system security parameters configured to prevent misuse?",
              "guidance": "Examine system configuration standards and interview personnel."
            },
            {
              "id": "2.2.7",
              "question": "Is all non-console administrative access encrypted using strong cryptography?",
              "guidance": "Examine system configuration settings."
            }
          ]
        },
        {
          "id": "2.3",
          "title": "Wireless environments are configured and managed securely.",
          "items": [
            {
              "id": "2.3.1",
              "question": "For wireless environments connected to the CDE or transmitting account data, are all wireless vendor defaults changed at installation or confirmed to be secure, including default wireless encryption keys, passwords on wireless access points, SNMP community strings, and firmware?",
              "guidance": "Examine policies and interview responsible personnel."
            },
            {
              "id": "2.3.2",
              "question": "For wireless environments connected to the CDE or transmitting account data, are wireless encryption keys changed whenever personnel with knowledge of the key leave the company or the role, or whenever a key is known or suspected to be compromised?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "3",
      "title": "Protect Stored Account Data",
      "objective": "Sensitive authentication data must not be stored after authorization.",
      "controls": [
        {
          "id": "3.2",
          "title": "Storage of account data is kept to a minimum.",
          "items": [
            {
              "id": "3.2.1",
              "question": "Are the full contents of any track, card verification codes/values, and PINs not stored after authorization, even if encrypted?",
              "guidance": "Examine data sources to verify sensitive authentication data is not stored after authorization."
            }
          ]
        }
      ]
    },
    {
      "id": "4",
      "title": "Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks",
      "objective": "Strong cryptography protects cardholder data transmitted over open, public networks.",
      "controls": [
        {
          "id": "4.1",
          "title": "Processes and mechanisms for protecting cardholder data with strong cryptography during transmission are defined and understood.",
          "items": [
            {
              "id": "4.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 4 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "4.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 4 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "4.2",
          "title": "PAN is protected with strong cryptography during transmission.",
          "items": [
            {
              "id": "4.2.1",
              "question": "Are strong cryptography and security protocols implemented to safeguard PAN during transmission over open, public networks, including only accepting trusted keys/certificates, confirming certificates are valid and not expired or revoked, the protocol supports only secure versions or configurations without fallback to insecure versions, and the encryption strength is appropriate for the encryption methodology in use?",
              "guidance": "Examine documented policies and inbound and outbound transmissions."
            },
            {
              "id": "4.2.1.1",
              "question": "Is an inventory of the entity's trusted keys and certificates maintained?",
              "guidance": "Examine documented policies to verify an inventory of trusted keys and certificates is maintained."
            },
            {
              "id": "4.2.2",
              "question": "Are PAN secured with strong cryptography whenever sent via end-user messaging technologies (for example, e-mail, instant messaging, SMS, chat)?",
              "guidance": "Examine policies and procedures."
            }
          ]
        }
      ]
    },
    {
      "id": "6",
      "title": "Develop and Maintain Secure Systems and Software",
      "objective": "The payment application must be patched and secured against known vulnerabilities.",
      "controls": [
        {
          "id": "6.3",
          "title": "Security vulnerabilities are identified and addressed.",
          "items": [
            {
              "id": "6.3.3",
              "question": "Are all system components protected from known vulnerabilities by installing applicable security patches/updates, with critical patches within one month and all other applicable patches within six months of release?",
              "guidance": "Examine policies and system configuration settings."
            }
          ]
        },
        {
          "id": "6.5",
          "title": "Changes to all system components are managed securely.",
          "items": [
            {
              "id": "6.5.1",
              "question": "Are changes to all system components in the production environment made according to established procedures that include documented reason and description, security impact documentation, authorized change approval, testing to verify no adverse security impact, and procedures to address failures?",
              "guidance": "Examine written change-control procedures and recent changes."
            }
          ]
        }
      ]
    },
    {
      "id": "8",
      "title": "Identify Users and Authenticate Access to System Components",
      "objective": "User identification and authentication controls protect access to system components and cardholder data.",
      "controls": [
        {
          "id": "8.1",
          "title": "Processes and mechanisms for identifying users and authenticating access to system components are defined and understood.",
          "items": [
            {
              "id": "8.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 8 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "8.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 8 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "8.2",
          "title": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.",
          "items": [
            {
              "id": "8.2.1",
              "question": "Are all users assigned a unique ID before allowing them to access system components or cardholder data?",
              "guidance": "Examine procedures and evidence."
            },
            {
              "id": "8.2.2",
              "question": "Are group, shared, or generic accounts only used when necessary on an exception basis, with account use prevented unless needed, use limited to the time needed, business justification documented, use explicitly approved by management, individual user identity confirmed before access granted, and every action attributable to an individual user?",
              "guidance": "Examine user account lists and interview personnel."
            },
            {
              "id": "8.2.4",
              "question": "Are additions, deletions, and modifications to user IDs, authentication factors, and other identifier objects authorized with appropriate approval and implemented with only the specified privileges?",
              "guidance": "Examine authentication policies and procedures and interview personnel."
            },
            {
              "id": "8.2.5",
              "question": "Is access for terminated users immediately deactivated or removed?",
              "guidance": "Examine termination procedures and a sample of recently terminated users."
            },
            {
              "id": "8.2.6",
              "question": "Are inactive user accounts removed or disabled within 90 days of inactivity?",
              "guidance": "Examine user accounts and interview personnel."
            },
            {
              "id": "8.2.7",
              "question": "Are accounts used by third parties to access, support, or maintain system components enabled only when needed and monitored for unexpected activity?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "8.2.8",
              "question": "If a user session has been idle for more than 15 minutes, is the user required to re-authenticate?",
              "guidance": "Examine system configuration settings."
            }
          ]
        },
        {
          "id": "8.3",
          "title": "User authentication for users and administrators is established and managed.",
          "items": [
            {
              "id": "8.3.1",
              "question": "Are all user passwords/passphrases for user access to system components set to meet minimum requirements of at least 12 characters (or eight if the system does not support 12) with both numeric and alphabetic characters?",
              "guidance": "Examine system configuration settings."
            },
            {
              "id": "8.3.2",
              "question": "Are strong cryptography used to render all authentication factors unreadable during transmission and storage?",
              "guidance": "Examine system configuration settings."
            },
            {
              "id": "8.3.4",
              "question": "Is invalid authentication attempt tracking implemented with account lockout after no more than 10 attempts for a minimum of 30 minutes or until reset by an administrator?",
              "guidance": "Examine system configuration settings."
            },
            {
              "id": "8.3.6",
              "question": "Do passwords/passphrases meet minimum complexity requirements upon set or reset?",
              "guidance": "Examine system configuration settings."
            },
            {
              "id": "8.3.9",
              "question": "If passwords/passphrases are used as the only authentication factor for user access, are passwords/passphrases changed at least once every 90 days OR is the security posture of accounts dynamically analyzed?",
              "guidance": "Examine system configuration settings."
            }
          ]
        },
        {
          "id": "8.4",
          "title": "Multi-factor authentication (MFA) is implemented to secure access into the CDE.",
          "items": [
            {
              "id": "8.4.1",
              "question": "Is MFA implemented for all non-console access into the CDE for personnel with administrative access?",
              "guidance": "Examine network and system configurations and interview personnel."
            },
            {
              "id": "8.4.2",
              "question": "Is MFA implemented for all access into the CDE?",
              "guidance": "Examine network and system configurations and interview personnel."
            },
            {
              "id": "8.4.3",
              "question": "Is MFA implemented for all remote network access originating from outside the entity's network that could access or impact the CDE, including all personnel and all third parties and vendors?",
              "guidance": "Examine network and system configurations and interview personnel."
            }
          ]
        },
        {
          "id": "8.6",
          "title": "Use of application and system accounts and associated authentication factors is strictly managed.",
          "items": [
            {
              "id": "8.6.1",
              "question": "If accounts used by systems or applications can be used for interactive login, are they managed to prevent use except when necessary, with documented justification, explicit management approval, and individual user identity confirmed?",
              "guidance": "Examine application/system accounts and interview personnel."
            },
            {
              "id": "8.6.2",
              "question": "Are passwords/passphrases for any application and system accounts not hard coded in scripts, configuration/property files, or source code?",
              "guidance": "Examine scripts, configuration files, and source code."
            },
            {
              "id": "8.6.3",
              "question": "Are passwords/passphrases for any application and system accounts changed periodically and upon suspicion or confirmation of compromise, and constructed with sufficient complexity?",
              "guidance": "Examine policies and procedures and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "10",
      "title": "Log and Monitor All Access to System Components and Cardholder Data",
      "objective": "Logging mechanisms and the ability to track user activities are critical for effective forensics and access controls.",
      "controls": [
        {
          "id": "10.1",
          "title": "Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documented.",
          "items": [
            {
              "id": "10.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 10 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "10.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 10 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "10.2",
          "title": "Audit logs capture all individual user access to cardholder data.",
          "items": [
            {
              "id": "10.2.1",
              "question": "Are audit logs enabled and active for all system components in the CDE?",
              "guidance": "Examine system configurations."
            },
            {
              "id": "10.2.1.1",
              "question": "Is all individual user access to cardholder data captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.2",
              "question": "Are all actions by any individual with root or administrative privileges captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.3",
              "question": "Is access to all audit logs captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.4",
              "question": "Are invalid logical access attempts captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.5",
              "question": "Are use of and changes to identification and authentication mechanisms, creation of new accounts, elevation of privileges, and all changes to accounts with root or administrative privileges captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.6",
              "question": "Are initialization, stopping, or pausing of the audit logs captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.7",
              "question": "Are creation and deletion of system-level objects captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.2",
              "question": "Do audit logs capture user identification, type of event, date and time, success or failure indication, origination of event, and identity or name of affected data, system component, resource, or service for each event?",
              "guidance": "Examine audit log configurations and a sample of audit logs."
            }
          ]
        },
        {
          "id": "10.3",
          "title": "Audit logs are protected from destruction and unauthorized modifications.",
          "items": [
            {
              "id": "10.3.1",
              "question": "Are log files protected to prevent modifications by individuals?",
              "guidance": "Examine system configurations and audit log files."
            },
            {
              "id": "10.3.2",
              "question": "Are log files protected from modification via centralized internal log server, external log server, or write-once media?",
              "guidance": "Examine log storage systems and configurations."
            },
            {
              "id": "10.3.3",
              "question": "Are log files promptly backed up to a centralized, secure, internal log server or other media that is difficult to alter?",
              "guidance": "Examine backup configurations and log storage."
            }
          ]
        },
        {
          "id": "10.4",
          "title": "Audit logs are reviewed to identify anomalies or suspicious activity.",
          "items": [
            {
              "id": "10.4.1",
              "question": "Are the following audit logs reviewed at least once daily: all security events, logs of all system components that store/process/transmit CHD/SAD, logs of all critical system components, and logs of all servers and system components performing security functions?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "10.4.1.1",
              "question": "Are automated mechanisms used to perform audit log reviews?",
              "guidance": "Examine policies, procedures, and system configurations."
            },
            {
              "id": "10.4.2",
              "question": "Are logs of all other system components reviewed periodically?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "10.4.3",
              "question": "Are exceptions and anomalies identified during the review process addressed?",
              "guidance": "Examine policies and procedures and interview personnel."
            }
          ]
        },
        {
          "id": "10.5",
          "title": "Audit log history is retained and available for analysis.",
          "items": [
            {
              "id": "10.5.1",
              "question": "Are audit logs retained for at least 12 months, with at least the most recent three months available for immediate analysis?",
              "guidance": "Examine audit log storage configurations and logs."
            }
          ]
        },
        {
          "id": "10.6",
          "title": "Time-synchronization mechanisms support consistent time settings across all systems.",
          "items": [
            {
              "id": "10.6.1",
              "question": "Are system clocks and time synchronized using time-synchronization technology?",
              "guidance": "Examine system configurations and time synchronization settings."
            },
            {
              "id": "10.6.2",
              "question": "Are systems configured to the correct and consistent time using designated central time server(s) that receive time from external sources based on International Atomic Time or UTC?",
              "guidance": "Examine system configurations."
            },
            {
              "id": "10.6.3",
              "question": "Are time synchronization settings and data protected with restricted access to time data and changes to time settings on critical systems logged and reviewed?",
              "guidance": "Examine system configurations."
            }
          ]
        },
        {
          "id": "10.7",
          "title": "Failures of critical security controls are detected, reported, and responded to promptly.",
          "items": [
            {
              "id": "10.7.2",
              "question": "Are failures of critical security controls detected, alerted, and addressed promptly, including NSCs, IDS/IPS, change-detection mechanisms, anti-malware, physical access controls, logical access controls, audit logging mechanisms, and segmentation controls?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "10.7.3",
              "question": "Are failures of critical security controls responded to promptly with restoration of security functions, documentation of duration and cause, risk assessment, and controls to prevent recurrence?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "11",
      "title": "Test Security of Systems and Networks Regularly",
      "objective": "Regular testing confirms that security controls remain effective.",
      "controls": [
        {
          "id": "11.1",
          "title": "Processes and mechanisms for regularly testing security of systems and networks are defined and understood.",
          "items": [
            {
              "id": "11.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 11 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "11.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 11 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "11.2",
          "title": "Wireless access points are identified and monitored, and unauthorized wireless access points are addressed.",
          "items": [
            {
              "id": "11.2.1",
              "question": "Are authorized and unauthorized wireless access points managed by testing for their presence at least once every three months or via automatic monitoring, and are all detected unauthorized access points responded to using the incident response plan?",
              "guidance": "Examine policies and procedures and interview responsible personnel."
            },
            {
              "id": "11.2.2",
              "question": "Is an inventory of authorized wireless access points maintained with documented business justification for each?",
              "guidance": "Examine the inventory of authorized wireless access points."
            }
          ]
        },
        {
          "id": "11.3",
          "title": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.",
          "items": [
            {
              "id": "11.3.1",
              "question": "Are internal vulnerability scans performed at least once every three months with high-risk and critical vulnerabilities resolved and rescans performed as needed?",
              "guidance": "Examine scan reports from the last 12 months and interview responsible personnel."
            },
            {
              "id": "11.3.1.1",
              "question": "Are all other applicable vulnerabilities addressed based on the risk defined in the entity's targeted risk analysis with rescans conducted as needed?",
              "guidance": "Examine policies and vulnerability scan reports."
            },
            {
              "id": "11.3.1.3",
              "question": "Are internal vulnerability scans performed after any significant change with vulnerabilities resolved and rescans conducted as needed?",
              "guidance": "Examine change control documentation and scan reports."
            },
            {
              "id": "11.3.2",
              "question": "Are external vulnerability scans performed at least once every three months by a PCI SSC Approved Scanning Vendor (ASV) with vulnerabilities resolved and rescans confirming resolution?",
              "guidance": "Examine scan reports from the last 12 months."
            },
            {
              "id": "11.3.2.1",
              "question": "Are external vulnerability scans performed after any significant change with vulnerabilities resolved and rescans conducted as needed?",
              "guidance": "Examine change control documentation and scan reports."
            }
          ]
        }
      ]
    },
    {
      "id": "12",
      "title": "Support Information Security with Organizational Policies and Programs",
      "objective": "Organizational policies and programs support the overall security of the payment application merchant environment.",
      "controls": [
        {
          "id": "12.1",
          "title": "A comprehensive information security policy that governs and provides direction for protection of the entity's information assets is known and current.",
          "items": [
            {
              "id": "12.1.1",
              "question": "Is an overall information security policy established, published, maintained, and disseminated to all relevant personnel and relevant vendors and business partners?",
              "guidance": "Examine the information security policy and interview personnel."
            },
            {
              "id": "12.1.2",
              "question": "Is the information security policy reviewed at least once every 12 months and updated when the environment changes?",
              "guidance": "Examine the information security policy and interview personnel."
            },
            {
              "id": "12.1.3",
              "question": "Does the information security policy clearly define roles and responsibilities for all personnel, and do all personnel acknowledge their responsibilities?",
              "guidance": "Examine the information security policy and interview personnel."
            },
            {
              "id": "12.1.4",
              "question": "Is responsibility for information security formally assigned to a CISO or other information security knowledgeable member of executive management?",
              "guidance": "Examine the information security policy and interview personnel."
            }
          ]
        },
        {
          "id": "12.2",
          "title": "Acceptable use policies for end-user technologies are defined and implemented.",
          "items": [
            {
              "id": "12.2.1",
              "question": "Are acceptable use policies for end-user technologies documented and implemented with explicit approval, defined acceptable uses, and a list of approved products?",
              "guidance": "Examine the acceptable use policy and interview personnel."
            }
          ]
        },
        {
          "id": "12.3",
          "title": "Risks to the cardholder data environment are formally identified, evaluated, and managed.",
          "items": [
            {
              "id": "12.3.1",
              "question": "For each PCI DSS requirement that specifies completion of a targeted risk analysis, is the analysis performed and documented including assets, threats, likelihood/impact factors, risk assignment, and a qualified individual performing the analysis?",
              "guidance": "Examine risk analysis documentation and interview personnel."
            },
            {
              "id": "12.3.3",
              "question": "Are all cryptographic cipher suites and protocols in use documented and reviewed at least once every 12 months to confirm they remain secure, including an up-to-date inventory with purpose and where used, active monitoring of industry trends, and a documented plan to respond to anticipated changes?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "12.3.4",
              "question": "Are hardware and software technologies reviewed at least once every 12 months to confirm they continue to receive security fixes and support the entity's PCI DSS requirements?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "12.5",
          "title": "PCI DSS scope is documented and validated.",
          "items": [
            {
              "id": "12.5.1",
              "question": "Is an inventory of system components that are in scope for PCI DSS maintained, including a description of function/use?",
              "guidance": "Examine system component inventory documentation."
            },
            {
              "id": "12.5.2",
              "question": "Is PCI DSS scope documented and confirmed at least once every 12 months and upon significant change, including all account data locations and flows, all applicable PCI DSS requirements, all CDE system components, and all segmentation controls?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "12.6",
          "title": "Security awareness education is an ongoing activity.",
          "items": [
            {
              "id": "12.6.1",
              "question": "Is a formal security awareness program implemented to make all personnel aware of the entity's information security policy and procedures and their role in protecting cardholder data?",
              "guidance": "Examine the security awareness program."
            },
            {
              "id": "12.6.2",
              "question": "Is the security awareness program reviewed at least once every 12 months and updated as needed to address new threats or vulnerabilities?",
              "guidance": "Examine the security awareness program and interview personnel."
            },
            {
              "id": "12.6.3",
              "question": "Are personnel trained upon hire and at least once every 12 months covering awareness of threats, acceptable use policies, and personnel roles in protecting cardholder data?",
              "guidance": "Examine security awareness training records and interview personnel."
            },
            {
              "id": "12.6.3.1",
              "question": "Does security awareness training include awareness of threats and vulnerabilities that could impact the security of the CDE, including phishing and related attacks?",
              "guidance": "Examine training content."
            },
            {
              "id": "12.6.3.2",
              "question": "Does security awareness training include awareness of the acceptable use policy for end-user technologies as specified in Requirement 12.2.1?",
              "guidance": "Examine training content."
            }
          ]
        },
        {
          "id": "12.7",
          "title": "Personnel are screened to reduce risks from insider threats.",
          "items": [
            {
              "id": "12.7.1",
              "question": "Are potential personnel who will have access to the CDE screened within the constraints of local laws prior to hire to minimize the risk of attacks from internal sources?",
              "guidance": "Examine hiring policies and procedures and interview personnel."
            }
          ]
        },
        {
          "id": "12.8",
          "title": "Risk to information assets associated with third-party service provider (TPSP) relationships is managed.",
          "items": [
            {
              "id": "12.8.1",
              "question": "Is a list of all TPSPs maintained with which account data is shared or that could affect the security of account data, including a description of services provided?",
              "guidance": "Examine the list of TPSPs."
            },
            {
              "id": "12.8.2",
              "question": "Are written agreements with all TPSPs maintained that include acknowledgment of TPSP responsibility for account data security?",
              "guidance": "Examine written agreements with TPSPs."
            },
            {
              "id": "12.8.3",
              "question": "Is an established process implemented for engaging TPSPs, including proper due diligence prior to engagement?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "12.8.4",
              "question": "Is a program implemented to monitor TPSPs' PCI DSS compliance status at least once every 12 months?",
              "guidance": "Examine documentation."
            },
            {
              "id": "12.8.5",
              "question": "Is information maintained about which PCI DSS requirements are managed by each TPSP, which by the entity, and any that are shared?",
              "guidance": "Examine documentation."
            }
          ]
        },
        {
          "id": "12.10",
          "title": "Suspected and confirmed security incidents that could impact the CDE are responded to immediately.",
          "items": [
            {
              "id": "12.10.1",
              "question": "Is an incident response plan created and implemented covering roles, responsibilities, communication strategies, containment and mitigation activities, business recovery, data backup, legal requirements, critical system coverage, and payment brand procedures?",
              "guidance": "Examine the incident response plan and interview personnel."
            },
            {
              "id": "12.10.2",
              "question": "Is the incident response plan reviewed and tested at least once every 12 months?",
              "guidance": "Examine the incident response plan and testing documentation."
            },
            {
              "id": "12.10.3",
              "question": "Are specific personnel designated to be available on a 24/7 basis to respond to suspected or confirmed security incidents?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "12.10.4",
              "question": "Is personnel appropriate to respond to a suspected or confirmed security incident trained at least once every 12 months?",
              "guidance": "Examine training documentation."
            },
            {
              "id": "12.10.4.1",
              "question": "Is the frequency of periodic training for incident response personnel defined in the entity's targeted risk analysis?",
              "guidance": "Examine the entity's targeted risk analysis."
            },
            {
              "id": "12.10.5",
              "question": "Is the incident response plan modified and evolved according to lessons learned and to incorporate industry developments?",
              "guidance": "Examine the incident response plan and interview personnel."
            },
            {
              "id": "12.10.7",
              "question": "Are incident response procedures in place to be initiated upon detection of stored PAN anywhere it is not expected, including determining what to do if PAN is discovered outside the CDE, root-cause analysis, and remediation of data leaks or process gaps?",
              "guidance": "Examine incident response procedures."
            }
          ]
        }
      ]
    }
  ]
}