[READ-ONLY] Archives [RETIRED] PCI DSS v3.0 Questions and Answers Forum

Build and Maintain a Secure Network and Systems (R Requirement 1: Install and maintain a firewall configuration to protect cardholder data Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data (Requirements 3-4) Requirement 3: Protect stored cardholder data Requirement 4: Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program (Requi Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs Requirement 6: Develop and maintain secure systems and applications Implement Strong Access Control Measures (Requirem Requirement 7: Restrict access to cardholder data by business need to know Requirement 8: Identify and authenticate access to system components Requirement 9: Restrict physical access to cardholder data Regularly Monitor and Test Networks (Requirements Requirement 10: Track and monitor all access to network resources and cardholder data Requirement 11: Regularly test security systems and processes Maintain an Information Security Policy (Requireme Requirement 12: Maintain a policy that addresses information security for all personnel Appendix

Topic	Replies	Views	Activity
About the [RETIRED] PCI DSS v3.0 Questions and Answers Forum category [RETIRED] PCI DSS v3.0 Questions and Answers Forum	0	7	January 23, 2023
[PCI DSS 3.0] 12.1 Establish, publish, maintain, and disseminate a security policy. Maintain an Information Security Policy (Requireme requirement-12:-main	1	3228	October 5, 2015
[PCI DSS 3.0] 11.3.1 Perform external penetration testing at least annually and after any significant infrastructu Regularly Monitor and Test Networks (Requirements requirement-11:-regu	1	3248	October 5, 2015
[PCI DSS 3.0] 1.1 Establish and implement firewall and router configuration standards that include the following Build and Maintain a Secure Network and Systems (R requirement-1:-insta	1	23443	April 22, 2015
[PCI DSS 3.0] 1.1.1 A formal process for approving and testing all network connections and changes to the firewall Build and Maintain a Secure Network and Systems (R requirement-1:-insta	1	3618	April 22, 2015
[PCI DSS 3.0] Compensating Control Requirement Number and Definition Appendix appendix-c:-compensa	0	3057	September 23, 2014
[PCI DSS 3.0] Compensating controls may be considered for most PCI DSS requirements when an entity cannot meet a r Appendix appendix-b:-compensa	0	1907	September 23, 2014
[PCI DSS 3.0] A.1.4 Enable processes to provide for timely forensic investigation in the event of a compromise to Appendix appendix-a:-addition	0	1949	September 23, 2014
[PCI DSS 3.0] A.1.3 Ensure logging and audit trails are enabled and unique to each entity’s cardholder data enviro Appendix appendix-a:-addition	0	1649	September 23, 2014
[PCI DSS 3.0] A.1.2 Restrict each entity’s access and privileges to its own cardholder data environment only. Appendix appendix-a:-addition	0	1622	September 23, 2014
[PCI DSS 3.0] A.1.1 Ensure that each entity only runs processes that have access to that entity’s cardholder data Appendix appendix-a:-addition	0	1581	September 23, 2014
[PCI DSS 3.0] A.1 Protect each entity’s (that is, merchant, service provider, or other entity) hosted environment Appendix appendix-a:-addition	0	1516	September 23, 2014
[PCI DSS 3.0] 12.10.6 Develop a process to modify and evolve the incident response plan according to lessons learn Maintain an Information Security Policy (Requireme requirement-12:-main	0	1752	September 23, 2014
[PCI DSS 3.0] 12.10.5 Include alerts from security monitoring systems, including but not limited to intrusion-dete Maintain an Information Security Policy (Requireme requirement-12:-main	0	1652	September 23, 2014
[PCI DSS 3.0] 12.10.4 Provide appropriate training to staff with security breach response responsibilities. Maintain an Information Security Policy (Requireme requirement-12:-main	0	2227	September 23, 2014
[PCI DSS 3.0] 12.10.3 Designate specific personnel to be available on a 24/7 basis to respond to alerts. Maintain an Information Security Policy (Requireme requirement-12:-main	0	2124	September 23, 2014
[PCI DSS 3.0] 12.10.2 Test the plan at least annually. Maintain an Information Security Policy (Requireme requirement-12:-main	0	2006	September 23, 2014
[PCI DSS 3.0] 12.10.1 Create the incident response plan to be implemented in the event of system breach. Ensure th Maintain an Information Security Policy (Requireme requirement-12:-main	0	5097	September 23, 2014
[PCI DSS 3.0] 12.10 Implement an incident response plan. Be prepared to respond immediately to a system breach. Maintain an Information Security Policy (Requireme requirement-12:-main	0	1267	September 23, 2014
[PCI DSS 3.0] 12.9 Additional requirement for service providers: Service providers acknowledge in writing to custo Maintain an Information Security Policy (Requireme requirement-12:-main	0	3620	September 23, 2014
[PCI DSS 3.0] 12.8.5 Maintain information about which PCI DSS requirements are managed by each service provider, a Maintain an Information Security Policy (Requireme requirement-12:-main	0	3094	September 23, 2014
[PCI DSS 3.0] 12.8.4 Maintain a program to monitor service providers’ PCI DSS compliance status at least annually. Maintain an Information Security Policy (Requireme requirement-12:-main	0	2352	September 23, 2014
[PCI DSS 3.0] 12.8.3 Ensure there is an established process for engaging service providers including proper due di Maintain an Information Security Policy (Requireme requirement-12:-main	0	2186	September 23, 2014
[PCI DSS 3.0] 12.8.2 Maintain a written agreement that includes an acknowledgement that the service providers are Maintain an Information Security Policy (Requireme requirement-12:-main	0	2316	September 23, 2014
[PCI DSS 3.0] 12.8.1 Maintain a list of service providers. Maintain an Information Security Policy (Requireme requirement-12:-main	0	1599	September 23, 2014
[PCI DSS 3.0] 12.8 Maintain and implement policies and procedures to manage service providers with whom cardholder Maintain an Information Security Policy (Requireme requirement-12:-main	0	1313	September 23, 2014
[PCI DSS 3.0] 12.7 Screen potential personnel prior to hire to minimize the risk of attacks from internal sources. Maintain an Information Security Policy (Requireme requirement-12:-main	0	2429	September 23, 2014
[PCI DSS 3.0] 12.6.2 Require personnel to acknowledge at least annually that they have read and understood the sec Maintain an Information Security Policy (Requireme requirement-12:-main	0	1790	September 23, 2014
[PCI DSS 3.0] 12.6.1 Educate personnel upon hire and at least annually. Maintain an Information Security Policy (Requireme requirement-12:-main	0	2691	September 23, 2014
[PCI DSS 3.0] 12.6 Implement a formal security awareness program to make all personnel aware of the importance of Maintain an Information Security Policy (Requireme requirement-12:-main	0	1478	September 23, 2014