path: root/data/saq_d_merchant.json

{
  "id": "saq_d_merchant",
  "name": "SAQ D (Merchant)",
  "version": "PCI DSS v4.0",
  "description": "For all merchants not included in the description for the other SAQ types. Covers all PCI DSS requirements.",
  "applicability": "This SAQ applies to merchants that store, process, or transmit cardholder data and do not fall into any other SAQ category. This includes merchants that store cardholder data electronically, merchants that have direct connections to the Internet from any system in their cardholder data environment, and merchants that process cardholder data on more than one type of terminal or system.",
  "requirements": [
    {
      "id": "1",
      "title": "Install and Maintain Network Security Controls",
      "objective": "Network security controls (NSCs) are the first line of defense against unauthorized access to systems containing cardholder data.",
      "controls": [
        {
          "id": "1.1",
          "title": "Processes and mechanisms for installing and maintaining network security controls are defined and understood.",
          "items": [
            {
              "id": "1.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 1 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "1.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 1 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "1.2",
          "title": "Network security controls (NSCs) are configured and maintained.",
          "items": [
            {
              "id": "1.2.1",
              "question": "Are configuration standards for all NSC rulesets defined and implemented, denying all traffic by default with only necessary traffic explicitly allowed?",
              "guidance": "Examine configuration standards and NSC configurations."
            },
            {
              "id": "1.2.2",
              "question": "Are all changes to network connections and NSC configurations managed in accordance with the change-control process defined at Requirement 6.5.1?",
              "guidance": "Examine network documentation and change-control records."
            },
            {
              "id": "1.2.3",
              "question": "Is an accurate network diagram(s) maintained that shows all connections between the CDE and other networks, including any wireless networks?",
              "guidance": "Examine network diagrams and interview personnel."
            },
            {
              "id": "1.2.4",
              "question": "Is an accurate data-flow diagram(s) maintained that shows all account data flows across systems and networks and is updated as needed upon changes to the environment?",
              "guidance": "Examine data-flow diagrams and interview personnel."
            },
            {
              "id": "1.2.5",
              "question": "Are all services, protocols, and ports allowed (inbound and outbound) identified, approved, and is there a defined business need for each?",
              "guidance": "Examine NSC configurations and interview personnel."
            },
            {
              "id": "1.2.6",
              "question": "Are security features defined and implemented for all services, protocols, and ports that are in use and considered to be insecure?",
              "guidance": "Examine NSC configuration settings."
            },
            {
              "id": "1.2.7",
              "question": "Are configurations of NSCs reviewed at least once every six months to confirm they remain appropriate and reflect current business needs?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "1.2.8",
              "question": "Are configuration files for NSCs secured from unauthorized access and kept consistent with active network configurations?",
              "guidance": "Examine configuration files for NSCs."
            }
          ]
        },
        {
          "id": "1.3",
          "title": "Network access to and from the cardholder data environment is restricted.",
          "items": [
            {
              "id": "1.3.1",
              "question": "Is inbound traffic to the CDE restricted to only that which is necessary, and is all other traffic denied?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.3.2",
              "question": "Is outbound traffic from the CDE restricted to only that which is necessary, and is all other traffic denied?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.3.3",
              "question": "Are NSCs installed between all wireless networks and the CDE, and do these NSCs deny or control all traffic from wireless environments into the CDE?",
              "guidance": "Examine NSC configurations."
            }
          ]
        },
        {
          "id": "1.4",
          "title": "Network connections between trusted and untrusted networks are controlled.",
          "items": [
            {
              "id": "1.4.1",
              "question": "Are NSCs implemented between trusted and untrusted networks?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.4.2",
              "question": "Does inbound traffic from untrusted networks to trusted networks pass through an NSC that denies all traffic not explicitly allowed?",
              "guidance": "Examine NSC configurations and interview personnel."
            },
            {
              "id": "1.4.3",
              "question": "Are anti-spoofing measures implemented to detect and block forged source IP addresses from entering the trusted network?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.4.4",
              "question": "Are system components that store cardholder data not directly accessible from untrusted networks?",
              "guidance": "Examine NSC configurations."
            },
            {
              "id": "1.4.5",
              "question": "Is the disclosure of internal IP addresses and routing information to unauthorized parties limited?",
              "guidance": "Examine NSC configurations."
            }
          ]
        },
        {
          "id": "1.5",
          "title": "Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.",
          "items": [
            {
              "id": "1.5.1",
              "question": "Are security controls implemented on any computing devices that connect to both untrusted networks (including the Internet) and the CDE, with specific configuration settings defined to prevent threats, controls actively running, and controls not alterable by users without documented management authorization?",
              "guidance": "Examine policies and configuration standards and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "2",
      "title": "Apply Secure Configurations to All System Components",
      "objective": "Malicious individuals often use vendor-supplied default passwords and settings to compromise systems.",
      "controls": [
        {
          "id": "2.1",
          "title": "Processes and mechanisms for applying secure configurations to all system components are defined and understood.",
          "items": [
            {
              "id": "2.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 2 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "2.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 2 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "2.2",
          "title": "System components are configured and managed securely.",
          "items": [
            {
              "id": "2.2.1",
              "question": "Are configuration standards developed, implemented, and maintained for all system components that address all known security vulnerabilities, are consistent with industry-accepted system hardening standards, updated as new vulnerability issues are identified, and applied when new systems are configured?",
              "guidance": "Examine system configuration standards and interview personnel."
            },
            {
              "id": "2.2.2",
              "question": "Are vendor default accounts managed by changing default passwords if used or removing/disabling accounts if not used?",
              "guidance": "Examine system configuration standards and interview personnel."
            },
            {
              "id": "2.2.3",
              "question": "Is all non-console administrative access encrypted using strong cryptography?",
              "guidance": "Examine system configuration settings and interview personnel."
            },
            {
              "id": "2.2.4",
              "question": "Are only necessary services, protocols, daemons, and functions enabled, and are all unnecessary functionality removed or disabled?",
              "guidance": "Examine system configuration standards and system components."
            },
            {
              "id": "2.2.5",
              "question": "If any insecure services, protocols, or daemons are present, is the business need documented and are additional security features implemented to reduce the risk?",
              "guidance": "Examine system configuration standards."
            },
            {
              "id": "2.2.6",
              "question": "Are system security parameters configured to prevent misuse?",
              "guidance": "Examine system configuration standards and interview personnel."
            },
            {
              "id": "2.2.7",
              "question": "Is all non-console administrative access encrypted using strong cryptography?",
              "guidance": "Examine system configuration settings."
            }
          ]
        },
        {
          "id": "2.3",
          "title": "Wireless environments are configured and managed securely.",
          "items": [
            {
              "id": "2.3.1",
              "question": "For wireless environments connected to the CDE or transmitting account data, are all wireless vendor defaults changed at installation or confirmed to be secure, including default wireless encryption keys, passwords on wireless access points, SNMP community strings, firmware, and other security-related wireless vendor defaults?",
              "guidance": "Examine policies and interview responsible personnel."
            },
            {
              "id": "2.3.2",
              "question": "For wireless environments connected to the CDE or transmitting account data, are wireless encryption keys changed whenever personnel with knowledge of the key leave the company or the role, or whenever a key is known or suspected to be compromised?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "3",
      "title": "Protect Stored Account Data",
      "objective": "Protection methods such as encryption, truncation, masking, and hashing are critical components of cardholder data protection.",
      "controls": [
        {
          "id": "3.1",
          "title": "Processes and mechanisms for protecting stored account data are defined and understood.",
          "items": [
            {
              "id": "3.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 3 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "3.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 3 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "3.2",
          "title": "Storage of account data is kept to a minimum.",
          "items": [
            {
              "id": "3.2.1",
              "question": "Are account data storage policies, procedures, and processes for retaining account data defined and implemented to cover all locations of stored account data, all stored account data including that not needed for business or legal/regulatory purposes, limiting data storage amount and retention time to that required for legal, regulatory, and/or business requirements, specific retention requirements with documented business justification, processes for secure deletion or rendering unrecoverable account data when no longer needed, and a process for verifying at least once every three months that stored account data exceeding the defined retention period has been securely deleted or rendered irrecoverable?",
              "guidance": "Examine policies and procedures for retaining and securely deleting cardholder data and interview responsible personnel."
            }
          ]
        },
        {
          "id": "3.3",
          "title": "Sensitive authentication data (SAD) is not stored after authorization.",
          "items": [
            {
              "id": "3.3.1",
              "question": "Are SAD not retained after authorization, even if encrypted, and is all sensitive authentication data received rendered unrecoverable upon completion of the authorization process?",
              "guidance": "Examine data sources to verify SAD is not stored after authorization."
            },
            {
              "id": "3.3.2",
              "question": "Are SAD that is stored electronically prior to completion of authorization encrypted using strong cryptography?",
              "guidance": "Examine system configurations and vendor documentation."
            },
            {
              "id": "3.3.3",
              "question": "Additional requirement for issuers and companies that support issuing services only: Is SAD stored encrypted using strong cryptography?",
              "guidance": "This requirement applies only to issuers and companies that support issuing services."
            }
          ]
        },
        {
          "id": "3.4",
          "title": "Access to displays of full PAN and ability to copy cardholder data are restricted.",
          "items": [
            {
              "id": "3.4.1",
              "question": "Are PANs rendered unreadable anywhere they are stored (including on portable digital media, backup media, in logs, and data received from wireless networks) by using one-way hashes based on strong cryptography, truncation, index tokens, or strong cryptography with associated key-management processes and procedures?",
              "guidance": "Examine data repositories and audit logs and a sample of media."
            },
            {
              "id": "3.4.2",
              "question": "When using remote-access technologies, are technical controls in place to prevent copy and/or relocation of PAN for all personnel, except for those with documented, explicit authorization and a legitimate, defined business need?",
              "guidance": "Examine system configurations for remote-access technologies."
            }
          ]
        },
        {
          "id": "3.5",
          "title": "Primary account number (PAN) is secured wherever it is stored.",
          "items": [
            {
              "id": "3.5.1",
              "question": "Are primary account numbers (PANs) secured with strong cryptography wherever they are stored?",
              "guidance": "Examine data repositories and system configurations."
            },
            {
              "id": "3.5.1.1",
              "question": "If disk-level or partition-level encryption (rather than file-, column-, or field-level database encryption) is used to render PAN unreadable, is logical access managed separately and independently of native operating system authentication and access control mechanisms, and are decryption keys not associated with user accounts?",
              "guidance": "Examine system configurations."
            },
            {
              "id": "3.5.1.2",
              "question": "If disk-level or partition-level encryption is used to render PAN unreadable, is it implemented on removable electronic media and for backups?",
              "guidance": "Examine system configurations."
            },
            {
              "id": "3.5.1.3",
              "question": "If hashing is used to render PAN unreadable (one-way hash with strong cryptography), are there controls in place to prevent the hashed PAN from being linked to the original PAN and the original PAN from being decrypted?",
              "guidance": "Examine vendor documentation and system configurations."
            }
          ]
        },
        {
          "id": "3.6",
          "title": "Cryptographic keys used to protect stored account data are secured.",
          "items": [
            {
              "id": "3.6.1",
              "question": "Are procedures and processes for protecting cryptographic keys used to protect stored account data documented and implemented, including restricting access to the fewest number of custodians necessary, key-encrypting keys at least as strong as data-encrypting keys, key-encrypting keys stored separately from data-encrypting keys, and keys stored securely in the fewest possible locations and forms?",
              "guidance": "Examine documented key-management policies and procedures and interview responsible personnel."
            },
            {
              "id": "3.6.1.1",
              "question": "Are secret and private keys used to encrypt/decrypt stored account data stored in one or more of the following forms: encrypted with a key-encrypting key that is at least as strong as the data-encrypting key and stored separately from the data-encrypting key, within a secure cryptographic device, or as at least two full-length key components or key shares?",
              "guidance": "Examine system configurations and key-storage locations."
            },
            {
              "id": "3.6.1.2",
              "question": "Are cryptographic keys in Requirement 3.6.1.1 accessed and used only under dual control?",
              "guidance": "Examine user access lists and interview responsible personnel."
            },
            {
              "id": "3.6.1.3",
              "question": "Are historical cryptographic keys retained to perform decryption/verification of previously encrypted data prevented from being used for encryption operations?",
              "guidance": "Examine key-management procedures and system configurations."
            },
            {
              "id": "3.6.1.4",
              "question": "Are cryptographic keys retired or replaced when the integrity of the key has been weakened or keys are suspected of being compromised, and are retired or replaced keys not used for encryption operations?",
              "guidance": "Examine key-change procedures and interview responsible personnel."
            }
          ]
        },
        {
          "id": "3.7",
          "title": "Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.",
          "items": [
            {
              "id": "3.7.1",
              "question": "Are key-management policies and procedures implemented to include generation of strong cryptographic keys?",
              "guidance": "Examine key-management procedures and interview responsible personnel."
            },
            {
              "id": "3.7.2",
              "question": "Are key-management policies and procedures implemented to include secure distribution of cryptographic keys?",
              "guidance": "Examine key-management procedures and interview responsible personnel."
            },
            {
              "id": "3.7.3",
              "question": "Are key-management policies and procedures implemented to include secure storage of cryptographic keys?",
              "guidance": "Examine key-management procedures and interview responsible personnel."
            },
            {
              "id": "3.7.4",
              "question": "Are cryptographic key changes performed for keys that have reached the end of their cryptoperiod, as defined by the associated application vendor or key owner and based on industry best practices?",
              "guidance": "Examine key-management procedures and interview responsible personnel."
            },
            {
              "id": "3.7.5",
              "question": "Are key-management policies and procedures implemented to include retirement or replacement of keys when the integrity of the key has been weakened or keys are suspected of being compromised, and are retired or replaced keys not used for encryption operations?",
              "guidance": "Examine key-change procedures and interview responsible personnel."
            },
            {
              "id": "3.7.6",
              "question": "If manual cleartext cryptographic key-management operations are performed by personnel, are key-management policies and procedures implemented to include split knowledge and dual control of keys?",
              "guidance": "Examine key-management procedures and observe key-management operations."
            },
            {
              "id": "3.7.7",
              "question": "Are key-management policies and procedures implemented to include prevention of unauthorized substitution of cryptographic keys?",
              "guidance": "Examine key-management procedures and interview responsible personnel."
            },
            {
              "id": "3.7.8",
              "question": "Are key-management policies and procedures implemented to include acknowledgment by key custodians that they understand and accept their key-custodian responsibilities?",
              "guidance": "Examine documentation to verify key custodians have acknowledged their responsibilities."
            },
            {
              "id": "3.7.9",
              "question": "Additional requirement for service providers only: Are documented policies and procedures to address changing of secret or private keys that may have been known to former employees implemented?",
              "guidance": "This requirement applies only to service providers."
            }
          ]
        }
      ]
    },
    {
      "id": "4",
      "title": "Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks",
      "objective": "Sensitive information must be encrypted during transmission over open, public networks because it is easy and common for a malicious individual to intercept and/or divert data while in transit.",
      "controls": [
        {
          "id": "4.1",
          "title": "Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks are defined and understood.",
          "items": [
            {
              "id": "4.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 4 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "4.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 4 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "4.2",
          "title": "PAN is protected with strong cryptography during transmission.",
          "items": [
            {
              "id": "4.2.1",
              "question": "Are strong cryptography and security protocols implemented to safeguard PAN during transmission over open, public networks, including only accepting trusted keys/certificates, confirming certificates are valid and not expired or revoked, the protocol supports only secure versions or configurations without fallback to insecure versions, and the encryption strength is appropriate for the encryption methodology in use?",
              "guidance": "Examine documented policies and procedures and examine inbound and outbound transmissions."
            },
            {
              "id": "4.2.1.1",
              "question": "Is an inventory of the entity's trusted keys and certificates maintained?",
              "guidance": "Examine documented policies to verify an inventory of trusted keys and certificates is maintained."
            },
            {
              "id": "4.2.2",
              "question": "Are PAN secured with strong cryptography whenever sent via end-user messaging technologies (for example, e-mail, instant messaging, SMS, chat)?",
              "guidance": "Examine policies and procedures."
            }
          ]
        }
      ]
    },
    {
      "id": "5",
      "title": "Protect All Systems and Networks from Malicious Software",
      "objective": "Malicious software (malware) exploits system vulnerabilities after entering the network via many business-approved activities.",
      "controls": [
        {
          "id": "5.1",
          "title": "Processes and mechanisms for protecting all systems and networks from malicious software are defined and understood.",
          "items": [
            {
              "id": "5.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 5 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "5.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 5 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "5.2",
          "title": "Malicious software (malware) is prevented, or detected and addressed.",
          "items": [
            {
              "id": "5.2.1",
              "question": "Is an anti-malware solution(s) deployed on all system components, except for those identified per the targeted risk analysis at Requirement 5.2.3 as not being at risk from malware?",
              "guidance": "Examine system configurations and interview personnel."
            },
            {
              "id": "5.2.2",
              "question": "Is the deployed anti-malware solution(s) kept current, performing periodic scans, generating audit logs, actively running, and not able to be disabled or altered by users unless specifically documented and authorized by management for a limited time?",
              "guidance": "Examine anti-malware configurations, audit logs, and interview personnel."
            },
            {
              "id": "5.2.3",
              "question": "Are any system components not at risk from malware evaluated periodically to confirm that the anti-malware solution is still not required, and is the evaluation documented and performed according to the entity's targeted risk analysis?",
              "guidance": "Examine documentation to verify non-covered system components have been evaluated for malware risk."
            },
            {
              "id": "5.2.3.1",
              "question": "Are all system components not at risk for malware evaluated at the frequency defined in the entity's targeted risk analysis?",
              "guidance": "Examine the entity's targeted risk analysis and documentation."
            }
          ]
        },
        {
          "id": "5.3",
          "title": "Anti-malware mechanisms and processes are active, maintained, and monitored.",
          "items": [
            {
              "id": "5.3.1",
              "question": "Is the anti-malware solution(s) kept current via automatic updates?",
              "guidance": "Examine anti-malware configurations and interview personnel."
            },
            {
              "id": "5.3.2",
              "question": "Is the anti-malware solution(s) performing periodic scans and active or continuous behavioral analysis of systems or processes when entering the network?",
              "guidance": "Examine anti-malware configurations."
            },
            {
              "id": "5.3.2.1",
              "question": "If periodic malware scans are performed to meet Requirement 5.3.2, are scans run at a frequency defined in the entity's targeted risk analysis?",
              "guidance": "Examine the entity's targeted risk analysis and documentation."
            },
            {
              "id": "5.3.3",
              "question": "For removable electronic media, is a scan performed when the media is inserted, connected, or logically mounted, or is the media blocked from use entirely?",
              "guidance": "Examine anti-malware configurations."
            },
            {
              "id": "5.3.4",
              "question": "Are audit logs for the anti-malware solution(s) enabled and retained in accordance with Requirement 10.5.1?",
              "guidance": "Examine anti-malware configurations."
            },
            {
              "id": "5.3.5",
              "question": "Are anti-malware mechanisms not alterable by users unless specifically documented and authorized by management on a case-by-case basis for a limited time period?",
              "guidance": "Examine anti-malware configurations and interview personnel."
            }
          ]
        },
        {
          "id": "5.4",
          "title": "Anti-phishing mechanisms protect users against phishing attacks.",
          "items": [
            {
              "id": "5.4.1",
              "question": "Are processes and automated mechanisms in place to detect and protect personnel against phishing attacks?",
              "guidance": "Examine system configurations and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "6",
      "title": "Develop and Maintain Secure Systems and Software",
      "objective": "Security vulnerabilities in systems and applications may allow criminals to access account data.",
      "controls": [
        {
          "id": "6.1",
          "title": "Processes and mechanisms for developing and maintaining secure systems and software are defined and understood.",
          "items": [
            {
              "id": "6.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 6 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "6.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 6 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "6.2",
          "title": "Bespoke and custom software are developed securely.",
          "items": [
            {
              "id": "6.2.1",
              "question": "Are bespoke and custom software developed securely based on industry standards and best practices for secure development, in accordance with PCI DSS, and incorporating security considerations during each stage of the software development lifecycle?",
              "guidance": "Examine written software development procedures and interview responsible personnel."
            },
            {
              "id": "6.2.2",
              "question": "Are software development personnel who work on bespoke and custom software trained at least once every 12 months on software security relevant to their job function and development languages, including secure software design and coding techniques?",
              "guidance": "Examine training records and interview software development personnel."
            },
            {
              "id": "6.2.3",
              "question": "Are all bespoke and custom software reviewed prior to being released into production to identify and correct potential coding vulnerabilities, with code reviews ensuring compliance with secure coding guidelines, looking for existing and emerging vulnerabilities, and implementing appropriate corrections prior to release?",
              "guidance": "Examine written policies and procedures and evidence of code review process."
            },
            {
              "id": "6.2.3.1",
              "question": "If manual code reviews are performed for bespoke and custom software prior to release to production, are code changes reviewed by individuals other than the originating code author and approved by management prior to release?",
              "guidance": "Examine policies and procedures and review records."
            },
            {
              "id": "6.2.4",
              "question": "Are software engineering techniques or other methods defined and in use to prevent or mitigate common software attacks in bespoke and custom software, including injection attacks, attacks on data and data structures, attacks on cryptography usage, attacks on business logic, cross-site scripting attacks, cross-site request forgery attacks, and broken access control attacks?",
              "guidance": "Examine documented procedures and evidence of technique implementation."
            }
          ]
        },
        {
          "id": "6.3",
          "title": "Security vulnerabilities are identified and addressed.",
          "items": [
            {
              "id": "6.3.1",
              "question": "Are security vulnerabilities identified and managed with new vulnerabilities identified using industry-recognized sources, assigned a risk ranking based on industry best practices including identification of all critical or high-risk vulnerabilities, and covering bespoke and custom and third-party software?",
              "guidance": "Examine policies and procedures."
            },
            {
              "id": "6.3.2",
              "question": "Is an inventory of bespoke and custom software maintained, and is a list of all third-party components, libraries, and frameworks maintained, analyzed at least annually to identify vulnerabilities, and are appropriate actions taken?",
              "guidance": "Examine the software inventory and interview personnel."
            },
            {
              "id": "6.3.3",
              "question": "Are all system components protected from known vulnerabilities by installing applicable security patches/updates, with critical patches within one month and all other applicable patches within six months of release?",
              "guidance": "Examine policies and system configuration settings."
            }
          ]
        },
        {
          "id": "6.4",
          "title": "Public-facing web applications are protected against attacks.",
          "items": [
            {
              "id": "6.4.1",
              "question": "For public-facing web applications, are new threats and vulnerabilities addressed on an ongoing basis and are these applications protected against known attacks by reviewing them via manual or automated application vulnerability security assessment tools or methods at least annually and after significant changes, or by installing an automated technical solution that continually detects and prevents web-based attacks?",
              "guidance": "Examine documented policies and evidence of security assessments or WAF deployment."
            },
            {
              "id": "6.4.2",
              "question": "For public-facing web applications, is an automated technical solution deployed that continually detects and prevents web-based attacks, is actively running and up to date, generates audit logs, and has audit logs retained and reviewed per Requirements 10.5.1 and 10.4.1?",
              "guidance": "Examine system configurations and security assessment results."
            },
            {
              "id": "6.4.3",
              "question": "Are all payment page scripts that are loaded and executed in the consumer's browser managed with a method to confirm each script is authorized, a method to assure the integrity of each script, and an inventory of all scripts with written justification for each?",
              "guidance": "Examine policies, procedures, and evidence of script management."
            }
          ]
        },
        {
          "id": "6.5",
          "title": "Changes to all system components are managed securely.",
          "items": [
            {
              "id": "6.5.1",
              "question": "Are changes to all system components in the production environment made according to established procedures that include documented reason and description, security impact documentation, authorized change approval, testing to verify no adverse security impact, for bespoke software testing per Requirement 6.2.4, and procedures to address failures?",
              "guidance": "Examine written change-control procedures and recent changes."
            },
            {
              "id": "6.5.2",
              "question": "Upon completion of a significant change, are all applicable PCI DSS requirements confirmed to be in place on all new or changed systems and networks and is documentation updated?",
              "guidance": "Examine policies and procedures and examine changes."
            },
            {
              "id": "6.5.3",
              "question": "Are pre-production environments separated from production environments and is separation enforced with access controls?",
              "guidance": "Examine network documentation and access controls."
            },
            {
              "id": "6.5.4",
              "question": "Are roles and functions separated between production and pre-production environments to provide accountability such that only reviewed and approved changes are deployed?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "6.5.5",
              "question": "Are live PANs not used in pre-production environments, except where those environments are included in the CDE and protected per all applicable PCI DSS requirements?",
              "guidance": "Examine policies, procedures, and evidence of live data usage."
            },
            {
              "id": "6.5.6",
              "question": "Are test data and test accounts removed from system components before the system goes into production?",
              "guidance": "Examine policies, procedures, and evidence of pre-production testing."
            }
          ]
        }
      ]
    },
    {
      "id": "7",
      "title": "Restrict Access to System Components and Cardholder Data by Business Need to Know",
      "objective": "To ensure that critical data can only be accessed by authorized personnel, systems and processes must be in place to limit access based on need to know and job responsibilities.",
      "controls": [
        {
          "id": "7.1",
          "title": "Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understood.",
          "items": [
            {
              "id": "7.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 7 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "7.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 7 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "7.2",
          "title": "Access to system components and data is appropriately defined and assigned.",
          "items": [
            {
              "id": "7.2.1",
              "question": "Is an access control model defined and implemented that includes granting access appropriate to the entity's business and access needs, basing access on users' job classification and function, and the least privileges required to perform a job function?",
              "guidance": "Examine policies and procedures and interview responsible personnel."
            },
            {
              "id": "7.2.2",
              "question": "Is access assigned to users, including privileged users, based on job classification and function, with all access based on least privilege required, based on job classification and functions assigned to users, and is the access needed documented and approved by authorized personnel?",
              "guidance": "Examine policies and procedures and interview responsible personnel."
            },
            {
              "id": "7.2.3",
              "question": "Is required privilege approved by authorized personnel?",
              "guidance": "Examine policies and procedures and interview responsible personnel."
            },
            {
              "id": "7.2.4",
              "question": "Are all user accounts and related access privileges reviewed at least once every six months to ensure that access remains appropriate, accounts are not excessive, and inappropriate accounts are addressed?",
              "guidance": "Examine documented results of periodic access reviews and interview responsible personnel."
            },
            {
              "id": "7.2.5",
              "question": "Are all application and system accounts and related access privileges assigned and managed based on the least privileges necessary for the operability of the system or application, with access limited only to the system, application, or process that requires the access?",
              "guidance": "Examine policies and procedures and interview responsible personnel."
            },
            {
              "id": "7.2.5.1",
              "question": "Are all access by application and system accounts and related access privileges reviewed periodically in accordance with the entity's targeted risk analysis?",
              "guidance": "Examine documented results of periodic access reviews and interview responsible personnel."
            },
            {
              "id": "7.2.6",
              "question": "Is all user access to query repositories of stored cardholder data restricted via applications or other programmatic methods with access and allowed actions based on user roles and least privilege, and only the responsible administrators can directly access or query repositories of stored CHD?",
              "guidance": "Examine policies and procedures and interview responsible personnel."
            }
          ]
        },
        {
          "id": "7.3",
          "title": "Access to system components and data is managed via an access control system(s).",
          "items": [
            {
              "id": "7.3.1",
              "question": "Is an access control system(s) in place that restricts access based on a user's need to know and is set to deny-all unless access is specifically allowed?",
              "guidance": "Examine system settings for the access control system(s) and interview responsible personnel."
            },
            {
              "id": "7.3.2",
              "question": "Is the access control system(s) configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function?",
              "guidance": "Examine system settings for the access control system(s) and interview responsible personnel."
            },
            {
              "id": "7.3.3",
              "question": "Is the access control system(s) maintained current?",
              "guidance": "Examine system settings for the access control system(s) and interview responsible personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "8",
      "title": "Identify Users and Authenticate Access to System Components",
      "objective": "Two fundamental principles of identifying and authenticating users are to know who is accessing your systems and to ensure that each person who accesses is positively identified.",
      "controls": [
        {
          "id": "8.1",
          "title": "Processes and mechanisms for identifying users and authenticating access to system components are defined and understood.",
          "items": [
            {
              "id": "8.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 8 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "8.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 8 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "8.2",
          "title": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.",
          "items": [
            {
              "id": "8.2.1",
              "question": "Are all users assigned a unique ID before allowing them to access system components or cardholder data?",
              "guidance": "Examine procedures and evidence."
            },
            {
              "id": "8.2.2",
              "question": "Are group, shared, or generic accounts only used when necessary on an exception basis, with use prevented unless needed, use limited to the time needed, business justification documented, use explicitly approved by management, individual user identity confirmed before access granted, and every action attributable to an individual user?",
              "guidance": "Examine user account lists and interview personnel."
            },
            {
              "id": "8.2.3",
              "question": "Are additional authentication factors required for all non-consumer user access to all systems and any accounts within the CDE?",
              "guidance": "Examine system configuration settings and interview personnel."
            },
            {
              "id": "8.2.4",
              "question": "Are additions, deletions, and modifications to user IDs, authentication factors, and other identifier objects authorized with appropriate approval and implemented with only the specified privileges?",
              "guidance": "Examine authentication policies and procedures and interview personnel."
            },
            {
              "id": "8.2.5",
              "question": "Is access for terminated users immediately deactivated or removed?",
              "guidance": "Examine termination procedures and a sample of recently terminated users."
            },
            {
              "id": "8.2.6",
              "question": "Are inactive user accounts removed or disabled within 90 days of inactivity?",
              "guidance": "Examine user accounts and interview personnel."
            },
            {
              "id": "8.2.7",
              "question": "Are accounts used by third parties to access, support, or maintain system components enabled only during the time period needed, disabled when not in use, and monitored for unexpected activity?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "8.2.8",
              "question": "If a user session has been idle for more than 15 minutes, is the user required to re-authenticate to re-activate the terminal or session?",
              "guidance": "Examine system configuration settings."
            }
          ]
        },
        {
          "id": "8.3",
          "title": "User authentication for users and administrators is established and managed.",
          "items": [
            {
              "id": "8.3.1",
              "question": "Are all user passwords/passphrases for user access to system components set to meet minimum requirements of at least 12 characters (or eight if the system does not support 12) with both numeric and alphabetic characters?",
              "guidance": "Examine system configuration settings."
            },
            {
              "id": "8.3.2",
              "question": "Are strong cryptography used to render all authentication factors unreadable during transmission and storage on all system components?",
              "guidance": "Examine vendor documentation and system configuration settings."
            },
            {
              "id": "8.3.3",
              "question": "Is user identity verified before modifying any authentication factor?",
              "guidance": "Examine procedures and observe personnel."
            },
            {
              "id": "8.3.4",
              "question": "Is invalid authentication attempt tracking implemented with account lockout after no more than 10 attempts for a minimum of 30 minutes or until reset by an administrator?",
              "guidance": "Examine system configuration settings."
            },
            {
              "id": "8.3.5",
              "question": "Are passwords/passphrases for first use and upon reset set to a unique value for each user and changed immediately after first use?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "8.3.6",
              "question": "Do passwords/passphrases meet minimum complexity requirements upon set or reset (minimum 12 characters with numeric and alphabetic)?",
              "guidance": "Examine system configuration settings."
            },
            {
              "id": "8.3.7",
              "question": "Are individuals not allowed to submit a new password/passphrase that is the same as any of the last four passwords/passphrases used?",
              "guidance": "Examine system configuration settings."
            },
            {
              "id": "8.3.8",
              "question": "Are authentication policies and procedures documented and communicated to all users including guidance on selecting strong authentication factors, protecting authentication factors, not reusing previous passwords, and changing passwords if compromised?",
              "guidance": "Examine authentication policies and procedures and interview personnel."
            },
            {
              "id": "8.3.9",
              "question": "If passwords/passphrases are used as the only authentication factor for user access, are passwords/passphrases changed at least once every 90 days OR is the security posture of accounts dynamically analyzed?",
              "guidance": "Examine system configuration settings."
            },
            {
              "id": "8.3.10",
              "question": "Additional requirement for service providers only: If passwords/passphrases are used as the only authentication factor for customer user access to cardholder data, is guidance provided to customers regarding changing their passwords/passphrases at a minimum annually?",
              "guidance": "This requirement applies only to service providers."
            },
            {
              "id": "8.3.10.1",
              "question": "Additional requirement for service providers only: If passwords/passphrases are used as the only authentication factor for customer user access, are customer passwords/passphrases changed at least once every 90 days or is the security posture of accounts dynamically analyzed?",
              "guidance": "This requirement applies only to service providers."
            },
            {
              "id": "8.3.11",
              "question": "Where authentication factors such as physical or logical security tokens, smart cards, or certificates are used, are they assigned to an individual user and not shared among multiple users, and are physical and/or logical controls in place to ensure only the intended user can use that factor?",
              "guidance": "Examine authentication policies and procedures and interview personnel."
            }
          ]
        },
        {
          "id": "8.4",
          "title": "Multi-factor authentication (MFA) is implemented to secure access into the CDE.",
          "items": [
            {
              "id": "8.4.1",
              "question": "Is MFA implemented for all non-console access into the CDE for personnel with administrative access?",
              "guidance": "Examine network and system configurations and interview personnel."
            },
            {
              "id": "8.4.2",
              "question": "Is MFA implemented for all access into the CDE?",
              "guidance": "Examine network and system configurations and interview personnel."
            },
            {
              "id": "8.4.3",
              "question": "Is MFA implemented for all remote network access originating from outside the entity's network that could access or impact the CDE, including all remote access by all personnel and all remote access by third parties and vendors?",
              "guidance": "Examine network and system configurations and interview personnel."
            }
          ]
        },
        {
          "id": "8.5",
          "title": "Multi-factor authentication (MFA) systems are configured to prevent misuse.",
          "items": [
            {
              "id": "8.5.1",
              "question": "Are MFA systems implemented as follows: the MFA system is not susceptible to replay attacks, MFA systems cannot be bypassed by any user including administrative users unless specifically documented and authorized by management for a limited time, at least two different types of authentication factors are used, and success of all authentication factors is required before access is granted?",
              "guidance": "Examine vendor system documentation and system configurations."
            }
          ]
        },
        {
          "id": "8.6",
          "title": "Use of application and system accounts and associated authentication factors is strictly managed.",
          "items": [
            {
              "id": "8.6.1",
              "question": "If accounts used by systems or applications can be used for interactive login, are they managed to prevent use except when necessary for an exceptional circumstance, with documented justification, explicit management approval, individual user identity confirmed, and every action attributable to an individual user?",
              "guidance": "Examine application/system accounts and interview personnel."
            },
            {
              "id": "8.6.2",
              "question": "Are passwords/passphrases for any application and system accounts that can be used for interactive login not hard coded in scripts, configuration/property files, or bespoke and custom source code?",
              "guidance": "Examine scripts, configuration files, and source code."
            },
            {
              "id": "8.6.3",
              "question": "Are passwords/passphrases for any application and system accounts changed periodically and upon suspicion or confirmation of compromise, and constructed with sufficient complexity?",
              "guidance": "Examine policies and procedures and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "9",
      "title": "Restrict Physical Access to Cardholder Data",
      "objective": "Any physical access to cardholder data or systems that store, process, or transmit cardholder data provides the opportunity for individuals to access and/or remove systems or hardcopies containing cardholder data.",
      "controls": [
        {
          "id": "9.1",
          "title": "Processes and mechanisms for restricting physical access to cardholder data are defined and understood.",
          "items": [
            {
              "id": "9.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 9 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "9.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 9 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "9.2",
          "title": "Physical access controls manage entry into facilities and systems containing cardholder data.",
          "items": [
            {
              "id": "9.2.1",
              "question": "Are appropriate physical access controls in place for facilities containing the CDE to distinguish between employees and visitors, including identification of personnel on-site, communicating changes to physical access requirements to facility security personnel, and revoking identification devices for personnel whose access has changed or been terminated?",
              "guidance": "Observe physical access controls and interview personnel."
            },
            {
              "id": "9.2.1.1",
              "question": "Is individual physical access to sensitive areas within the CDE monitored with either video cameras or physical access control mechanisms, and is the data reviewed and correlated with other entries, and stored for at least three months unless otherwise restricted by law?",
              "guidance": "Examine documentation and observe physical access control mechanisms."
            },
            {
              "id": "9.2.2",
              "question": "Are physical and/or logical controls implemented to restrict use of publicly accessible network jacks within the facility?",
              "guidance": "Examine policies and procedures and observe network jacks."
            },
            {
              "id": "9.2.3",
              "question": "Is physical access to wireless access points, gateways, networking/communications hardware, and telecommunication lines within the facility restricted?",
              "guidance": "Examine policies and procedures and observe physical access controls."
            },
            {
              "id": "9.2.4",
              "question": "Is access to consoles in sensitive areas restricted via locking when not in use?",
              "guidance": "Examine policies and procedures and observe consoles."
            }
          ]
        },
        {
          "id": "9.3",
          "title": "Physical access for personnel and visitors is authorized and managed.",
          "items": [
            {
              "id": "9.3.1",
              "question": "Is all physical access by personnel to the CDE authorized before being granted and revoked immediately upon termination?",
              "guidance": "Examine lists of personnel with physical access and interview personnel responsible for granting access."
            },
            {
              "id": "9.3.1.1",
              "question": "Is access to the CDE by visitors authorized before entering areas where cardholder data is processed or maintained, visitors are escorted at all times within such areas, and visitors are clearly identified and distinguished from personnel?",
              "guidance": "Observe procedures for visitor access and examine visitor logs."
            },
            {
              "id": "9.3.2",
              "question": "Are procedures implemented to require visitors to register before entering the CDE, be given a physical token that expires and identifies them as a non-permanent employee, and surrender the physical token before leaving the facility or at the date of expiration?",
              "guidance": "Examine visitor control procedures and documentation."
            },
            {
              "id": "9.3.3",
              "question": "Are visitor badges or identification devices surrendered or deactivated before visitors leave the facility or upon expiration?",
              "guidance": "Examine visitor control procedures and observe visitor badges."
            },
            {
              "id": "9.3.4",
              "question": "Is a visitor log used to maintain a physical audit trail of visitor activity in the facility and in computer rooms where cardholder data is present, reviewed periodically, and retained for at least three months?",
              "guidance": "Examine the visitor log and interview personnel."
            }
          ]
        },
        {
          "id": "9.4",
          "title": "Media with cardholder data is securely accessed, distributed, and destroyed.",
          "items": [
            {
              "id": "9.4.1",
              "question": "Are all media with cardholder data physically secured?",
              "guidance": "Examine documentation and observe physical media storage."
            },
            {
              "id": "9.4.1.1",
              "question": "Is offline media backup with cardholder data stored in a secure location?",
              "guidance": "Examine documentation and observe storage location."
            },
            {
              "id": "9.4.1.2",
              "question": "Is the security of the offline media backup storage location reviewed at least once every 12 months?",
              "guidance": "Examine documentation to verify annual security reviews of the offline media backup storage location."
            },
            {
              "id": "9.4.2",
              "question": "Are all media with cardholder data classified in accordance with the sensitivity of the data?",
              "guidance": "Examine documentation and observe media classification."
            },
            {
              "id": "9.4.3",
              "question": "Is media with cardholder data sent by secured courier or other delivery method that can be accurately tracked?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "9.4.4",
              "question": "Is management approval obtained prior to moving media with cardholder data from a secured area?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "9.4.5",
              "question": "Are inventory logs of all electronic media with cardholder data maintained?",
              "guidance": "Examine documentation to verify inventory logs of all electronic media are maintained."
            },
            {
              "id": "9.4.5.1",
              "question": "Are inventories of electronic media with cardholder data conducted at least once every 12 months?",
              "guidance": "Examine documentation to verify inventories are conducted at least annually."
            },
            {
              "id": "9.4.6",
              "question": "Are hard-copy materials with cardholder data destroyed when no longer needed via cross-cut shredding, incineration, or pulping, and stored in secure containers prior to destruction?",
              "guidance": "Examine the media destruction policy and interview personnel."
            },
            {
              "id": "9.4.7",
              "question": "Are electronic media with cardholder data destroyed when no longer needed by physically destroying the electronic media or rendering the cardholder data unrecoverable?",
              "guidance": "Examine the media destruction policy and observe the destruction process."
            }
          ]
        },
        {
          "id": "9.5",
          "title": "Point-of-interaction (POI) devices are protected from tampering and unauthorized substitution.",
          "items": [
            {
              "id": "9.5.1",
              "question": "Are POI devices that capture payment card data via direct physical interaction protected from tampering and unauthorized substitution, including maintaining a list of POI devices, periodically inspecting POI devices, and training personnel to be aware of suspicious behavior and to report tampering or unauthorized substitution?",
              "guidance": "Examine documented policies and procedures and interview responsible personnel."
            },
            {
              "id": "9.5.1.1",
              "question": "Is the list of POI devices maintained and does it include make and model, location, and device serial number or other method of unique identification?",
              "guidance": "Examine the list of POI devices and interview personnel."
            },
            {
              "id": "9.5.1.2",
              "question": "Are POI device surfaces periodically inspected to detect tampering and unauthorized substitution at a frequency defined in the entity's targeted risk analysis, and are all POI devices inspected?",
              "guidance": "Examine documented procedures and interview personnel."
            },
            {
              "id": "9.5.1.2.1",
              "question": "Are inspections of POI devices performed at the frequency defined in the entity's targeted risk analysis?",
              "guidance": "Examine the entity's targeted risk analysis and compare to inspection evidence."
            },
            {
              "id": "9.5.1.3",
              "question": "Is training provided to personnel to be aware of attempted tampering or replacement of POI devices, including verifying third-party identities, not installing/replacing/returning devices without verification, reporting suspicious behavior, and recognizing tampering indicators?",
              "guidance": "Examine training materials and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "10",
      "title": "Log and Monitor All Access to System Components and Cardholder Data",
      "objective": "Logging mechanisms and the ability to track user activities are critical for effective forensics and access controls.",
      "controls": [
        {
          "id": "10.1",
          "title": "Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documented.",
          "items": [
            {
              "id": "10.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 10 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "10.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 10 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "10.2",
          "title": "Audit logs capture all individual user access to cardholder data.",
          "items": [
            {
              "id": "10.2.1",
              "question": "Are audit logs enabled and active for all system components in the CDE?",
              "guidance": "Examine system configurations."
            },
            {
              "id": "10.2.1.1",
              "question": "Is all individual user access to cardholder data captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.2",
              "question": "Are all actions by any individual with root or administrative privileges captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.3",
              "question": "Is access to all audit logs captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.4",
              "question": "Are invalid logical access attempts captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.5",
              "question": "Are use of and changes to identification and authentication mechanisms, creation of new accounts, elevation of privileges, and all changes to accounts with root or administrative privileges captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.6",
              "question": "Are initialization, stopping, or pausing of the audit logs captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.1.7",
              "question": "Are creation and deletion of system-level objects captured in audit logs?",
              "guidance": "Examine audit log configurations."
            },
            {
              "id": "10.2.2",
              "question": "Do audit logs capture user identification, type of event, date and time, success or failure indication, origination of event, and identity or name of affected data, system component, resource, or service for each event?",
              "guidance": "Examine audit log configurations and a sample of audit logs."
            }
          ]
        },
        {
          "id": "10.3",
          "title": "Audit logs are protected from destruction and unauthorized modifications.",
          "items": [
            {
              "id": "10.3.1",
              "question": "Are log files protected to prevent modifications by individuals?",
              "guidance": "Examine system configurations and audit log files."
            },
            {
              "id": "10.3.2",
              "question": "Are log files protected from modification via centralized internal log server, external log server, or write-once media?",
              "guidance": "Examine log storage systems and configurations."
            },
            {
              "id": "10.3.3",
              "question": "Are log files promptly backed up to a centralized, secure, internal log server or other media that is difficult to alter?",
              "guidance": "Examine backup configurations and log storage."
            },
            {
              "id": "10.3.4",
              "question": "Are file integrity monitoring or change-detection mechanisms used on audit logs to ensure that existing log data cannot be changed without generating alerts?",
              "guidance": "Examine system configurations and file integrity monitoring settings."
            }
          ]
        },
        {
          "id": "10.4",
          "title": "Audit logs are reviewed to identify anomalies or suspicious activity.",
          "items": [
            {
              "id": "10.4.1",
              "question": "Are the following audit logs reviewed at least once daily: all security events, logs of all system components that store/process/transmit CHD/SAD, logs of all critical system components, and logs of all servers and system components performing security functions?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "10.4.1.1",
              "question": "Are automated mechanisms used to perform audit log reviews?",
              "guidance": "Examine policies, procedures, and system configurations."
            },
            {
              "id": "10.4.2",
              "question": "Are logs of all other system components reviewed periodically?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "10.4.2.1",
              "question": "Are reviews of logs of other system components performed at the frequency defined in the entity's targeted risk analysis?",
              "guidance": "Examine the entity's targeted risk analysis and compare to log review frequency."
            },
            {
              "id": "10.4.3",
              "question": "Are exceptions and anomalies identified during the review process addressed?",
              "guidance": "Examine policies and procedures and interview personnel."
            }
          ]
        },
        {
          "id": "10.5",
          "title": "Audit log history is retained and available for analysis.",
          "items": [
            {
              "id": "10.5.1",
              "question": "Are audit logs retained for at least 12 months, with at least the most recent three months available for immediate analysis?",
              "guidance": "Examine audit log storage configurations and logs."
            }
          ]
        },
        {
          "id": "10.6",
          "title": "Time-synchronization mechanisms support consistent time settings across all systems.",
          "items": [
            {
              "id": "10.6.1",
              "question": "Are system clocks and time synchronized using time-synchronization technology?",
              "guidance": "Examine system configurations and time synchronization settings."
            },
            {
              "id": "10.6.2",
              "question": "Are systems configured to the correct and consistent time using designated central time server(s) that receive time from external sources based on International Atomic Time or UTC, with systems receiving time only from designated central time server(s)?",
              "guidance": "Examine system configurations."
            },
            {
              "id": "10.6.3",
              "question": "Are time synchronization settings and data protected with restricted access to time data and changes to time settings on critical systems logged and reviewed?",
              "guidance": "Examine system configurations."
            }
          ]
        },
        {
          "id": "10.7",
          "title": "Failures of critical security controls are detected, reported, and responded to promptly.",
          "items": [
            {
              "id": "10.7.1",
              "question": "Additional requirement for service providers only: Are failures of critical security controls detected, alerted, and addressed promptly, including failures of NSCs, IDS/IPS, FIM, anti-malware, physical access controls, logical access controls, audit logging mechanisms, and segmentation controls?",
              "guidance": "This requirement applies only to service providers."
            },
            {
              "id": "10.7.2",
              "question": "Are failures of critical security controls detected, alerted, and addressed promptly, including NSCs, IDS/IPS, change-detection mechanisms, anti-malware, physical access controls, logical access controls, audit logging mechanisms, and segmentation controls?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "10.7.3",
              "question": "Are failures of critical security controls responded to promptly with restoration of security functions, documentation of duration and cause, identification and addressing of security issues during the failure, risk assessment to determine further actions, and controls to prevent recurrence?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        }
      ]
    },
    {
      "id": "11",
      "title": "Test Security of Systems and Networks Regularly",
      "objective": "Vulnerabilities are being discovered continuously by malicious individuals and researchers. System components, processes, and custom software should be tested frequently to ensure security controls continue to reflect a changing environment.",
      "controls": [
        {
          "id": "11.1",
          "title": "Processes and mechanisms for regularly testing security of systems and networks are defined and understood.",
          "items": [
            {
              "id": "11.1.1",
              "question": "Are all security policies and operational procedures that are identified in Requirement 11 documented, kept up to date, in use, and known to all affected parties?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "11.1.2",
              "question": "Are all roles and responsibilities for performing activities in Requirement 11 documented, assigned, and understood?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "11.2",
          "title": "Wireless access points are identified and monitored, and unauthorized wireless access points are addressed.",
          "items": [
            {
              "id": "11.2.1",
              "question": "Are authorized and unauthorized wireless access points managed by testing for their presence at least once every three months or via automatic monitoring, and are all detected unauthorized access points responded to using the incident response plan?",
              "guidance": "Examine policies and procedures and interview responsible personnel."
            },
            {
              "id": "11.2.2",
              "question": "Is an inventory of authorized wireless access points maintained with documented business justification for each?",
              "guidance": "Examine the inventory of authorized wireless access points."
            }
          ]
        },
        {
          "id": "11.3",
          "title": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.",
          "items": [
            {
              "id": "11.3.1",
              "question": "Are internal vulnerability scans performed at least once every three months with high-risk and critical vulnerabilities resolved and rescans performed as needed, using kept-up-to-date scanning tools and qualified personnel?",
              "guidance": "Examine scan reports from the last 12 months and interview responsible personnel."
            },
            {
              "id": "11.3.1.1",
              "question": "Are all other applicable vulnerabilities addressed based on the risk defined in the entity's targeted risk analysis with rescans conducted as needed?",
              "guidance": "Examine policies and vulnerability scan reports."
            },
            {
              "id": "11.3.1.2",
              "question": "Are internal vulnerability scans performed via authenticated scanning with sufficient privileges, documenting systems unable to accept credentials, and disabling network accounts used for scanning when not in use?",
              "guidance": "Examine scan configuration settings and interview personnel."
            },
            {
              "id": "11.3.1.3",
              "question": "Are internal vulnerability scans performed after any significant change with vulnerabilities resolved and rescans conducted as needed?",
              "guidance": "Examine change control documentation and scan reports."
            },
            {
              "id": "11.3.2",
              "question": "Are external vulnerability scans performed at least once every three months by a PCI SSC Approved Scanning Vendor (ASV) with vulnerabilities resolved and rescans confirming resolution?",
              "guidance": "Examine scan reports from the last 12 months."
            },
            {
              "id": "11.3.2.1",
              "question": "Are external vulnerability scans performed after any significant change with vulnerabilities resolved and rescans conducted as needed?",
              "guidance": "Examine change control documentation and scan reports."
            }
          ]
        },
        {
          "id": "11.4",
          "title": "External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected.",
          "items": [
            {
              "id": "11.4.1",
              "question": "Is a penetration testing methodology defined, documented, and implemented including industry-accepted approaches, coverage for the entire CDE perimeter and critical systems, testing from both inside and outside the network, validation of segmentation and scope-reduction controls, application-layer penetration testing covering Requirement 6.2.4 vulnerabilities, network-layer penetration tests, review of threats and vulnerabilities experienced in the last 12 months, and a documented approach to assessing and addressing risk from exploitable vulnerabilities?",
              "guidance": "Examine penetration testing methodology."
            },
            {
              "id": "11.4.2",
              "question": "Is internal penetration testing performed at least once every 12 months and after any significant infrastructure or application upgrade or change?",
              "guidance": "Examine scope of work and results from the most recent penetration testing."
            },
            {
              "id": "11.4.3",
              "question": "Is external penetration testing performed at least once every 12 months and after any significant infrastructure or application upgrade or change?",
              "guidance": "Examine scope of work and results from the most recent penetration testing."
            },
            {
              "id": "11.4.4",
              "question": "Are exploitable vulnerabilities and security weaknesses found during penetration testing corrected in accordance with the entity's assessment of risk, and is penetration testing repeated to verify corrections?",
              "guidance": "Examine penetration testing results and retesting evidence."
            },
            {
              "id": "11.4.5",
              "question": "If segmentation is used to isolate the CDE from other networks, are penetration tests performed on segmentation controls at least once every 12 months and after any changes to segmentation controls/methods to verify that the segmentation controls are operational and effective and isolate all out-of-scope systems from systems in the CDE?",
              "guidance": "Examine penetration test results and interview responsible personnel."
            },
            {
              "id": "11.4.6",
              "question": "Additional requirement for service providers only: If segmentation is used to isolate the CDE from other networks, are penetration tests on segmentation controls performed at least once every six months and after any changes to segmentation controls?",
              "guidance": "This requirement applies only to service providers."
            },
            {
              "id": "11.4.7",
              "question": "Additional requirement for multi-tenant service providers only: Are multi-tenant service providers supporting their customers for external penetration testing?",
              "guidance": "This requirement applies only to multi-tenant service providers."
            }
          ]
        },
        {
          "id": "11.5",
          "title": "Network intrusions and unexpected file changes are detected and responded to.",
          "items": [
            {
              "id": "11.5.1",
              "question": "Is an intrusion-detection and/or intrusion-prevention system (IDS/IPS) deployed to detect and/or prevent intrusions into the network, monitoring all traffic at the perimeter of the CDE as well as at critical points in the CDE, and alerting personnel to suspected compromises?",
              "guidance": "Examine system configurations and network diagrams and interview responsible personnel."
            },
            {
              "id": "11.5.1.1",
              "question": "Additional requirement for service providers only: Is an intrusion-detection and/or intrusion-prevention system (IDS/IPS) deployed that detects, alerts on/prevents, and addresses covert malware communication channels?",
              "guidance": "This requirement applies only to service providers."
            },
            {
              "id": "11.5.2",
              "question": "Is a change-detection mechanism (for example, file integrity monitoring tools) deployed to alert personnel to unauthorized modification (including changes, additions, and deletions) of critical files, performing critical file comparisons at least once weekly?",
              "guidance": "Examine system configurations and interview responsible personnel."
            }
          ]
        },
        {
          "id": "11.6",
          "title": "Unauthorized changes on payment pages are detected and responded to.",
          "items": [
            {
              "id": "11.6.1",
              "question": "Is a change- and tamper-detection mechanism deployed to alert personnel to unauthorized modification (including indicators of compromise, changes, additions, and deletions) to the HTTP headers and the contents of payment pages as received by the consumer browser, with the mechanism configured to evaluate the received HTTP header and payment page and functions performed at least once every seven days or at a frequency defined in the entity's targeted risk analysis?",
              "guidance": "Examine system configurations and the mechanism for detecting unauthorized changes."
            }
          ]
        }
      ]
    },
    {
      "id": "12",
      "title": "Support Information Security with Organizational Policies and Programs",
      "objective": "The organization's overall information security policy sets the tone for the whole entity and informs employees of what is expected of them.",
      "controls": [
        {
          "id": "12.1",
          "title": "A comprehensive information security policy that governs and provides direction for protection of the entity's information assets is known and current.",
          "items": [
            {
              "id": "12.1.1",
              "question": "Is an overall information security policy established, published, maintained, and disseminated to all relevant personnel, as well as to relevant vendors and business partners?",
              "guidance": "Examine the information security policy and interview personnel."
            },
            {
              "id": "12.1.2",
              "question": "Is the information security policy reviewed at least once every 12 months and updated when the environment changes?",
              "guidance": "Examine the information security policy and interview personnel."
            },
            {
              "id": "12.1.3",
              "question": "Does the information security policy clearly define information security roles and responsibilities for all personnel, and do all personnel understand and acknowledge their information security responsibilities?",
              "guidance": "Examine the information security policy and interview personnel."
            },
            {
              "id": "12.1.4",
              "question": "Is responsibility for information security formally assigned to a Chief Information Security Officer or other information security knowledgeable member of executive management?",
              "guidance": "Examine the information security policy and interview personnel."
            }
          ]
        },
        {
          "id": "12.2",
          "title": "Acceptable use policies for end-user technologies are defined and implemented.",
          "items": [
            {
              "id": "12.2.1",
              "question": "Are acceptable use policies for end-user technologies documented and implemented with explicit approval by authorized parties required, acceptable uses of the technology defined, and a list of products approved by the company for employee use?",
              "guidance": "Examine the acceptable use policy and interview personnel."
            }
          ]
        },
        {
          "id": "12.3",
          "title": "Risks to the cardholder data environment are formally identified, evaluated, and managed.",
          "items": [
            {
              "id": "12.3.1",
              "question": "For each PCI DSS requirement that specifies a targeted risk analysis, is the analysis performed and documented including assets being protected, threats, factors contributing to likelihood and/or impact, resulting risk assignment, and a qualified individual performing the analysis?",
              "guidance": "Examine risk analysis documentation and interview personnel."
            },
            {
              "id": "12.3.2",
              "question": "Is a targeted risk analysis performed for each PCI DSS requirement met via the customized approach, including thorough analysis of each customized control, evidence that each control meets the intent of the related requirement, and evidence of ongoing monitoring?",
              "guidance": "Examine targeted risk analyses performed for customized approach controls."
            },
            {
              "id": "12.3.3",
              "question": "Are all cryptographic cipher suites and protocols in use documented and reviewed at least once every 12 months to confirm they remain secure, including an up-to-date inventory with purpose and where used, active monitoring of industry trends, and a documented plan to respond to anticipated changes?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "12.3.4",
              "question": "Are hardware and software technologies reviewed at least once every 12 months to confirm they continue to receive security fixes from vendors and continue to support the entity's PCI DSS requirements, with an analysis for any issues noted and a plan to address them?",
              "guidance": "Examine documentation and interview personnel."
            }
          ]
        },
        {
          "id": "12.4",
          "title": "PCI DSS compliance is managed.",
          "items": [
            {
              "id": "12.4.1",
              "question": "Additional requirement for service providers only: Is executive management responsibility for the protection of cardholder data and a PCI DSS compliance program established, including overall accountability for maintaining PCI DSS compliance and defining a charter for a PCI DSS compliance program communicated to executive management?",
              "guidance": "This requirement applies only to service providers."
            },
            {
              "id": "12.4.2",
              "question": "Additional requirement for service providers only: Are reviews performed at least once every three months to confirm that personnel are following security policies and operational procedures, and are review results reviewed and addressed by the responsible executive management?",
              "guidance": "This requirement applies only to service providers."
            },
            {
              "id": "12.4.2.1",
              "question": "Additional requirement for service providers only: Are reviews performed per Requirement 12.4.2 documented, including results and review and sign-off by personnel assigned responsibility for the PCI DSS compliance program?",
              "guidance": "This requirement applies only to service providers."
            }
          ]
        },
        {
          "id": "12.5",
          "title": "PCI DSS scope is documented and validated.",
          "items": [
            {
              "id": "12.5.1",
              "question": "Is an inventory of system components that are in scope for PCI DSS maintained, including a description of function/use, kept current, including all hardware and software in use, all network connections, and all inventory data in the scope documentation?",
              "guidance": "Examine system component inventory documentation and interview personnel."
            },
            {
              "id": "12.5.2",
              "question": "Is PCI DSS scope documented and confirmed by the entity at least once every 12 months and upon significant change to the in-scope environment, including identifying all locations and flows of account data, confirming all applicable PCI DSS requirements are applied, all system components in the CDE, and all segmentation controls and their effectiveness?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "12.5.2.1",
              "question": "Additional requirement for service providers only: Is PCI DSS scope documented and confirmed by the entity at least once every six months and upon significant changes to the in-scope environment?",
              "guidance": "This requirement applies only to service providers."
            },
            {
              "id": "12.5.3",
              "question": "Additional requirement for service providers only: Are significant changes to organizational structure resulting in a formal review of the impact on PCI DSS scope and applicability of controls with results documented?",
              "guidance": "This requirement applies only to service providers."
            }
          ]
        },
        {
          "id": "12.6",
          "title": "Security awareness education is an ongoing activity.",
          "items": [
            {
              "id": "12.6.1",
              "question": "Is a formal security awareness program implemented to make all personnel aware of the entity's information security policy and procedures and personnel's role in protecting the cardholder data?",
              "guidance": "Examine the security awareness program."
            },
            {
              "id": "12.6.2",
              "question": "Is the security awareness program reviewed at least once every 12 months and updated as needed to address new threats or vulnerabilities that may impact the security of the entity's CDE or the information provided to personnel about their role in protecting cardholder data?",
              "guidance": "Examine the security awareness program and interview personnel."
            },
            {
              "id": "12.6.3",
              "question": "Are personnel trained upon hire and at least once every 12 months, with training including awareness of threats and vulnerabilities that could impact the security of the CDE, awareness of acceptable use policies for end-user technologies, and awareness of the roles of personnel in protecting cardholder data?",
              "guidance": "Examine security awareness training records and interview personnel."
            },
            {
              "id": "12.6.3.1",
              "question": "Does security awareness training include awareness of threats and vulnerabilities that could impact the security of the CDE, including phishing and related attacks?",
              "guidance": "Examine security awareness training content."
            },
            {
              "id": "12.6.3.2",
              "question": "Does security awareness training include awareness of the acceptable use policy for end-user technologies as specified in Requirement 12.2.1?",
              "guidance": "Examine security awareness training content."
            }
          ]
        },
        {
          "id": "12.7",
          "title": "Personnel are screened to reduce risks from insider threats.",
          "items": [
            {
              "id": "12.7.1",
              "question": "Are potential personnel who will have access to the CDE screened, within the constraints of local laws, prior to hire to minimize the risk of attacks from internal sources?",
              "guidance": "Examine hiring policies and procedures and interview personnel."
            }
          ]
        },
        {
          "id": "12.8",
          "title": "Risk to information assets associated with third-party service provider (TPSP) relationships is managed.",
          "items": [
            {
              "id": "12.8.1",
              "question": "Is a list of all third-party service providers (TPSPs) maintained with which account data is shared or that could affect the security of account data, including a description of the service(s) provided?",
              "guidance": "Examine policies and procedures and the list of TPSPs."
            },
            {
              "id": "12.8.2",
              "question": "Are written agreements with all TPSPs maintained to include an acknowledgment by TPSPs that they are responsible for the security of account data the TPSPs possess or otherwise store, process, or transmit on behalf of the entity?",
              "guidance": "Examine written agreements with TPSPs."
            },
            {
              "id": "12.8.3",
              "question": "Is an established process implemented for engaging TPSPs, including proper due diligence prior to engagement?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "12.8.4",
              "question": "Is a program implemented to monitor TPSPs' PCI DSS compliance status at least once every 12 months?",
              "guidance": "Examine documentation and interview personnel."
            },
            {
              "id": "12.8.5",
              "question": "Is information maintained about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared?",
              "guidance": "Examine documentation."
            }
          ]
        },
        {
          "id": "12.9",
          "title": "Third-party service providers (TPSPs) support their customers' PCI DSS compliance.",
          "items": [
            {
              "id": "12.9.1",
              "question": "Additional requirement for service providers only: Is there a written acknowledgment provided to customers that TPSPs are responsible for the security of account data that the TPSP possesses or otherwise stores, processes, or transmits on behalf of the entity?",
              "guidance": "This requirement applies only to service providers."
            },
            {
              "id": "12.9.2",
              "question": "Additional requirement for service providers only: Are TPSPs supporting the PCI DSS compliance of their customers by providing the status of relevant PCI DSS requirements upon request and providing sufficient information about the PCI DSS requirements for which they are responsible?",
              "guidance": "This requirement applies only to service providers."
            }
          ]
        },
        {
          "id": "12.10",
          "title": "Suspected and confirmed security incidents that could impact the CDE are responded to immediately.",
          "items": [
            {
              "id": "12.10.1",
              "question": "Is an incident response plan created and implemented to be initiated in the event of a system breach, and does the plan address roles and responsibilities and communication and contact strategies including notification of payment brands and acquirers, incident response procedures with containment and mitigation activities, business recovery and continuity procedures, data backup processes, analysis of legal requirements for reporting compromises, coverage and responses of all critical system components, and reference or inclusion of incident response procedures from payment brands?",
              "guidance": "Examine the incident response plan and interview personnel."
            },
            {
              "id": "12.10.1.1",
              "question": "Does the incident response plan include processes for responding to expected and unexpected media queries and processes for designating specific personnel to handle media queries?",
              "guidance": "Examine the incident response plan."
            },
            {
              "id": "12.10.2",
              "question": "Is the incident response plan reviewed and tested at least once every 12 months, including all elements listed in Requirement 12.10.1?",
              "guidance": "Examine the incident response plan and testing documentation."
            },
            {
              "id": "12.10.3",
              "question": "Are specific personnel designated to be available on a 24/7 basis to respond to suspected or confirmed security incidents?",
              "guidance": "Examine policies and procedures and interview personnel."
            },
            {
              "id": "12.10.4",
              "question": "Is personnel appropriate to respond to a suspected or confirmed security incident trained at least once every 12 months?",
              "guidance": "Examine training documentation and interview personnel."
            },
            {
              "id": "12.10.4.1",
              "question": "Is the frequency of periodic training for incident response personnel defined in the entity's targeted risk analysis?",
              "guidance": "Examine the entity's targeted risk analysis."
            },
            {
              "id": "12.10.5",
              "question": "Is the incident response plan modified and evolved according to lessons learned and to incorporate industry developments?",
              "guidance": "Examine the incident response plan and interview personnel."
            },
            {
              "id": "12.10.6",
              "question": "Is the incident response plan modified and evolved according to lessons learned and to incorporate industry developments?",
              "guidance": "Examine the incident response plan and interview personnel."
            },
            {
              "id": "12.10.7",
              "question": "Are incident response procedures in place to be initiated upon detection of stored PAN anywhere it is not expected, including determining what to do if PAN is discovered outside the CDE, root-cause analysis, remediation of data leaks or process gaps, identifying the origin of the PAN, and identifying all locations the PAN has been sent to or stored in?",
              "guidance": "Examine incident response procedures."
            }
          ]
        }
      ]
    }
  ]
}