{"id": "pcidss_4", "policy": "PCI-DSS", "title": "Payment Card Industry - Data Security Standard (PCI-DSS)", "source": "https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf", "definition_location": "/aptdata/openscap/scap-security-guide/controls/pcidss_4.yml", "controls": [{"id": "1.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 1 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 1 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "1.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 1 are documented, assigned and understood\nby the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 1 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "1.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for installing and maintaining network security controls are defined and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["1.1.1", "1.1.2"]}, {"id": "1.2.1", "levels": ["base"], "notes": "Examples of NSCs covered by these configuration standards include, but are not limited to,\nfirewalls, routers configured with access control lists, and cloud virtual networks. The\nobjective of this requirement is to ensure the way that NSCs are configured and operate\nare defined and consistently applied. While the tooling and standards can be automated,\nthe review of allowed accesses should be manual as different sites may have different\npolicies.", "title": "Configuration standards for NSC rulesets are Defined, Implemented and Maintained.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["package_nftables_installed", "package_firewalld_installed", "service_firewalld_enabled", "service_nftables_disabled"], "controls": []}, {"id": "1.2.2", "levels": ["base"], "notes": "Changes to network connections and NSCs cannot result in misconfiguration, implementation\nof insecure services, or unauthorized network connections. Changes to network connections\ninclude the addition, removal, or modification of a connection. Changes to NSC\nconfigurations include those related to the component itself as well as those affecting\nhow it performs its security function. A formal change control process should be in place.", "title": "All changes to network connections and to configurations of NSCs are approved and managed in accordance with the change control process defined at Requirement 6.5.1.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "1.2.3", "levels": ["base"], "notes": "A representation of the boundaries between the CDE, all trusted networks, and all\nuntrusted networks, is maintained and available. A current network diagram(s) or other\ntechnical or topological solution that identifies network connections and devices can be\nused to meet this requirement.", "title": "An accurate network diagram(s) is maintained that shows all connections between the CDE and other networks, including any wireless networks.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "1.2.4", "levels": ["base"], "notes": "", "title": "An accurate data-flow diagram(s) is maintained", "description": "An accurate data-flow diagram(s) is maintained that meets the following:\n  - Shows all account data flows across systems and networks\n  - Updated as needed upon changes to the environment", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "1.2.5", "levels": ["base"], "notes": "", "title": "All services, protocols, and ports allowed are identified, approved, and have a defined business need.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["configure_firewalld_ports"], "rules": [], "controls": []}, {"id": "1.2.6", "levels": ["base"], "notes": "The specific risks associated with the use of insecure services, protocols, and ports are\nunderstood, assessed, and appropriately mitigated. The selected rules here basically\nremove services without encryption and restricted some common services.", "title": "Security features are defined and implemented for all services, protocols, and ports that are in use and considered to be insecure, such that the risk is mitigated.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["grub2_enable_selinux", "selinux_state", "selinux_policytype", "package_libselinux_installed", "selinux_confinement_of_daemons", "var_selinux_policy_name=targeted", "var_selinux_state=enforcing"], "controls": []}, {"id": "1.2.7", "levels": ["base"], "notes": "Some configuration automation solution, such as Ansible could be helpful here.", "title": "Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective.", "description": "NSC configurations that allow or restrict access to trusted networks are verified\nperiodically to ensure that only authorized connections with a current business\njustification are permitted.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "1.2.8", "levels": ["base"], "notes": "", "title": "Configuration files for NSCs are secured from unauthorized access and kept consistent with active network configurations.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["file_owner_etc_issue_net", "file_groupowner_etc_issue_net", "file_permissions_etc_issue_net", "network_nmcli_permissions"], "controls": []}, {"id": "1.2", "levels": ["base"], "notes": "", "title": "Network Security Controls (NSCs) are configured and maintained.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["grub2_enable_selinux", "selinux_state", "network_nmcli_permissions", "package_nftables_installed", "file_permissions_etc_issue_net", "selinux_policytype", "file_owner_etc_issue_net", "package_libselinux_installed", "file_groupowner_etc_issue_net", "service_nftables_disabled", "selinux_confinement_of_daemons", "package_firewalld_installed", "service_firewalld_enabled", "var_selinux_policy_name=targeted", "var_selinux_state=enforcing"], "controls": ["1.2.1", "1.2.2", "1.2.3", "1.2.4", "1.2.5", "1.2.6", "1.2.7", "1.2.8"]}, {"id": "1.3.1", "levels": ["base"], "notes": "", "title": "Inbound traffic to the CDE is restricted to only traffic that is necessary", "description": "Inbound traffic to the CDE is restricted as follows:\n- To only traffic that is necessary.\n- All other traffic is specifically denied.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["configure_firewalld_ports", "ensure_firewall_rules_for_open_ports", "set_firewalld_default_zone", "nftables_ensure_default_deny_policy"], "controls": []}, {"id": "1.3.2", "levels": ["base"], "notes": "It appears there is no rule in the project to restrict outbound traffic on the firewall.\nPerhaps a rule to automates this would do more harm than good. Probably a manual\nassessment is more reasonable here.", "title": "Outbound traffic from the CDE is restricted to only traffic that is necessary", "description": "Outbound traffic from the CDE is restricted as follows:\n- To only traffic that is necessary.\n- All other traffic is specifically denied.", "rationale": null, "automated": "no", "status": "pending", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "1.3.3", "levels": ["base"], "notes": "Wireless interfaces are not expected in servers so they are disabled by default in this\npolicy.", "title": "NSCs are installed between all wireless networks and the CDE, regardless of whether the wireless network is a CDE.", "description": "NSCs are installed between all wireless networks and the CDE, regardless of whether the\nwireless network is a CDE, such that:\n- All wireless traffic from wireless networks into the CDE is denied by default.\n- Only wireless traffic with an authorized business purpose is allowed into the CDE.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["wireless_disable_interfaces"], "controls": []}, {"id": "1.3", "levels": ["base"], "notes": "", "title": "Network access to and from the cardholder data environment is restricted.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["ensure_firewall_rules_for_open_ports", "wireless_disable_interfaces", "set_firewalld_default_zone", "configure_firewalld_ports", "nftables_ensure_default_deny_policy"], "controls": ["1.3.1", "1.3.2", "1.3.3"]}, {"id": "1.4.1", "levels": ["base"], "notes": "Trusted and untrusted networks are expected to be different for each environment.\nBut loopback traffic is assumed to be trusted and even necessary for some services.\nThis requirement is complements 1.2.1 and 1.3.1 requirements.", "title": "NSCs are implemented between trusted and untrusted networks.", "description": "Unauthorized traffic cannot traverse network boundaries between trusted and untrusted\nnetworks.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["firewalld_loopback_traffic_restricted", "set_ip6tables_default_rule", "set_ipv6_loopback_traffic", "firewalld_loopback_traffic_trusted", "set_loopback_traffic"], "controls": []}, {"id": "1.4.2", "levels": ["base"], "notes": "Probably missing some relevant IPv6 related rules. Needs to be investigated.", "title": "Inbound traffic from untrusted networks to trusted networks is restricted.", "description": "Inbound traffic from untrusted networks to trusted networks is restricted to:\n- Communications with system components that are authorized to provide publicly accessible\nservices, protocols, and ports.\n- Stateful responses to communications initiated by system components in a trusted network.\n- All other traffic is denied.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["sysctl_net_ipv4_icmp_echo_ignore_broadcasts", "sysctl_net_ipv6_conf_default_accept_source_route", "kernel_module_sctp_disabled", "kernel_module_dccp_disabled", "sysctl_net_ipv4_icmp_ignore_bogus_error_responses", "postfix_network_listening_disabled", "var_postfix_inet_interfaces=loopback-only"], "controls": []}, {"id": "1.4.3", "levels": ["base"], "notes": "Probably missing some relevant IPv6 related rules. Needs to be investigated.", "title": "Anti-spoofing measures are implemented to detect and block forged source IP addresses from entering the trusted network.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["sysctl_net_ipv4_conf_default_accept_redirects", "sysctl_net_ipv4_conf_all_secure_redirects", "sysctl_net_ipv4_conf_all_rp_filter", "sysctl_net_ipv4_ip_forward", "sysctl_net_ipv4_tcp_syncookies"], "controls": []}, {"id": "1.4.4", "levels": ["base"], "notes": "This requirement is not intended to apply to storage of account data in volatile memory\nbut does apply where memory is being treated as persistent storage (for example, RAM\ndisk). Account data can only be stored in volatile memory during the time necessary to\nsupport the associated business process (for example, until completion of the related\npayment card transaction).", "title": "System components that store cardholder data are not directly accessible from untrusted networks.", "description": null, "rationale": null, "automated": "no", "status": "pending", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["configure_firewalld_ports"], "rules": [], "controls": []}, {"id": "1.4.5", "levels": ["base"], "notes": "", "title": "The disclosure of internal IP addresses and routing information is limited to only authorized parties.", "description": "Internal network information is protected from unauthorized disclosure.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["network_sniffer_disabled", "sysctl_net_ipv4_conf_all_send_redirects", "sysctl_net_ipv4_conf_default_send_redirects"], "controls": []}, {"id": "1.4", "levels": ["base"], "notes": "", "title": "Network connections between trusted and untrusted networks are controlled.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["sysctl_net_ipv6_conf_default_accept_source_route", "set_ipv6_loopback_traffic", "kernel_module_sctp_disabled", "sysctl_net_ipv4_conf_all_send_redirects", "sysctl_net_ipv4_icmp_ignore_bogus_error_responses", "postfix_network_listening_disabled", "firewalld_loopback_traffic_restricted", "sysctl_net_ipv4_icmp_echo_ignore_broadcasts", "sysctl_net_ipv4_conf_all_secure_redirects", "sysctl_net_ipv4_ip_forward", "firewalld_loopback_traffic_trusted", "sysctl_net_ipv4_tcp_syncookies", "set_loopback_traffic", "sysctl_net_ipv4_conf_default_accept_redirects", "network_sniffer_disabled", "set_ip6tables_default_rule", "sysctl_net_ipv4_conf_all_rp_filter", "kernel_module_dccp_disabled", "sysctl_net_ipv4_conf_default_send_redirects", "var_postfix_inet_interfaces=loopback-only"], "controls": ["1.4.1", "1.4.2", "1.4.3", "1.4.4", "1.4.5"]}, {"id": "1.5.1", "levels": ["base"], "notes": "To ensure this requirement, a manual analysis of site policy and topology is inevitable.\nFrom the technical perspective, previous requirements should already cover this\nrequirement at some level.", "title": "Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks (including the Internet) and the CDE", "description": "Security controls are implemented on any computing devices, including company- and\nemployee-owned devices, that connect to both untrusted networks (including the Internet)\nand the CDE as follows:\n- Specific configuration settings are defined to prevent threats being introduced into the\nentity's network.\n- Security controls are actively running.\n- Security controls are not alterable by users of the computing devices unless\nspecifically documented and authorized by management on a case-by-case basis for a limited\nperiod.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["ensure_firewall_rules_for_open_ports", "set_firewalld_default_zone", "selinux_state"], "rules": [], "controls": []}, {"id": "1.5", "levels": ["base"], "notes": "", "title": "Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["1.5.1"]}, {"id": "2.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 2 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 2 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "2.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 2 are documented, assigned and understood\nby the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 2 are documented, assigned, and understood.", "description": "Day-to-day responsibilities for performing all the activities in Requirement 2 are\nallocated. Personnel are accountable for successful, continuous operation of these\nrequirements.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "2.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for applying secure configurations to all system components are defined and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["2.1.1", "2.1.2"]}, {"id": "2.2.1", "levels": ["base"], "notes": "Interestingly this requirement recommends other standards, such as Center for Internet\nSecurity (CIS), International Organization for Standardization (ISO), National Institute\nof Standards and Technology (NIST), Cloud Security Alliance, and product vendors. So, the\nrules included here are very generic in terms of hardening.", "title": "Configuration standards are developed, implemented, and maintained", "description": "Configuration standards are developed, implemented, and maintained to:\n- Cover all system components.\n- Address all known security vulnerabilities.\n- Be consistent with industry-accepted system hardening standards or vendor hardening\nrecommendations.\n- Be updated as new vulnerability issues are identified, as defined in Requirement 6.3.1.\n- Be applied when new systems are configured and verified as in place before or\nimmediately after a system component is connected to a production environment.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["install_PAE_kernel_on_x86-32", "bios_enable_execution_restrictions"], "controls": []}, {"id": "2.2.2", "levels": ["base"], "notes": "Also related to requirement 8.2.6 and 8.3.5.", "title": "Vendor default accounts are managed.", "description": "Vendor default accounts are managed as follows:\n- If the vendor default account(s) will be used, the default password is changed per\nRequirement 8.3.6.\n- If the vendor default account(s) will not be used, the account is removed or disabled.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["ensure_root_password_configured", "no_empty_passwords_etc_shadow"], "controls": []}, {"id": "2.2.3", "levels": ["base"], "notes": "", "title": "Primary functions requiring different security levels are managed", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "2.2.4", "levels": ["base"], "notes": "", "title": "Only necessary services, protocols, daemons, and functions are enabled, and all unnecessary functionality is removed or disabled", "description": "System components cannot be compromised by exploiting unnecessary functionality present in\nthe system component.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["package_bind_removed", "package_dnsmasq_removed", "package_httpd_removed", "package_nfs-utils_removed", "package_openldap-clients_removed", "package_openldap-servers_removed", "package_rsync_removed", "package_samba_removed", "package_squid_removed", "package_vsftpd_removed", "service_cups_disabled", "service_nfs_disabled"], "rules": ["package_talk_removed", "package_rsh_removed", "package_rsh-server_removed", "package_tftp-server_removed", "package_telnet-server_removed", "service_rsyncd_disabled", "package_telnet_removed", "package_xinetd_removed", "package_ypbind_removed", "mask_nonessential_services", "service_avahi-daemon_disabled", "package_net-snmp_removed", "package_tftp_removed", "package_ftp_removed", "package_talk-server_removed", "package_dhcp_removed", "service_rpcbind_disabled", "package_ypserv_removed"], "controls": []}, {"id": "2.2.5", "levels": ["base"], "notes": "Known insecure services are removed or disabled by 2.2.4\nGeneral security measures are covered by 1.2.6\nThis requirement is more about checking exceptions and their respective documentation.", "title": "If any insecure services, protocols, or daemons are present, business justification is documented and the risk is reduced.", "description": "If any insecure services, protocols, or daemons are present:\n- Business justification is documented.\n- Additional security features are documented and implemented that reduce the risk of\nusing insecure services, protocols, or daemons.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "2.2.6", "levels": ["base"], "notes": "This requirement is not specific but also points to 2.2.1, where other policies are\nreferenced. Therefore, the most common rules related to system configuration in order to\nprevent misuse and selected in main profiles are also selected here.", "title": "System security parameters are configured to prevent misuse.", "description": "System components cannot be compromised because of incorrect security parameter\nconfiguration.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["file_groupowner_backup_etc_shadow", "file_permissions_cron_daily", "sshd_disable_root_login", "file_owner_cron_weekly", "file_owner_backup_etc_passwd", "sshd_set_max_sessions", "no_files_unowned_by_user", "file_owner_crontab", "dir_perms_world_writable_sticky_bits", "file_owner_backup_etc_shadow", "file_groupowner_cron_hourly", "file_permissions_user_cfg", "sudo_custom_logfile", "file_permissions_backup_etc_group", "ensure_pam_wheel_group_empty", "file_permissions_sshd_private_key", "file_owner_backup_etc_group", "sudo_add_use_pty", "file_groupowner_cron_weekly", "use_pam_wheel_group_for_su", "file_owner_etc_passwd", "file_permissions_ungroupowned", "file_groupowner_grub2_cfg", "file_groupowner_etc_group", "file_at_deny_not_exist", "file_owner_at_allow", "sudo_require_reauthentication", "sshd_disable_x11_forwarding", "file_permissions_backup_etc_passwd", "file_owner_cron_daily", "file_permissions_cron_d", "file_groupowner_backup_etc_group", "file_groupowner_etc_shadow", "package_sudo_installed", "file_permissions_cron_weekly", "file_owner_cron_allow", "package_cron_installed", "file_owner_etc_shadow", "file_permissions_cron_hourly", "file_permissions_cron_monthly", "file_owner_grub2_cfg", "sshd_limit_user_access", "file_permissions_cron_allow", "file_groupowner_crontab", "file_permissions_unauthorized_world_writable", "file_groupowner_cron_monthly", "sshd_disable_rhosts", "file_groupowner_etc_passwd", "file_owner_cron_d", "file_groupowner_cron_d", "sshd_enable_pam", "file_owner_cron_monthly", "file_owner_cron_hourly", "file_cron_deny_not_exist", "file_groupowner_cron_allow", "sshd_disable_tcp_forwarding", "file_permissions_sshd_pub_key", "sshd_set_maxstartups", "file_permissions_backup_etc_shadow", "file_groupowner_user_cfg", "sshd_set_loglevel_verbose", "file_groupowner_at_allow", "file_owner_user_cfg", "file_groupowner_cron_daily", "file_permissions_sshd_config", "file_permissions_at_allow", "sshd_do_not_permit_user_env", "file_permissions_etc_shadow", "sshd_set_login_grace_time", "file_permissions_etc_passwd", "file_permissions_crontab", "file_owner_etc_group", "file_permissions_grub2_cfg", "sshd_set_max_auth_tries", "sshd_disable_empty_passwords", "file_permissions_etc_group", "sudo_require_authentication", "file_groupowner_backup_etc_passwd", "var_sshd_set_login_grace_time=60"], "controls": []}, {"id": "2.2.7", "levels": ["base"], "notes": "Related to requirement 12.3.3.", "title": "All non-console administrative access is encrypted using strong cryptography.", "description": "Cleartext administrative authorization factors cannot be read or intercepted from any\nnetwork transmissions. This includes administrative access via browser-based interfaces\nand application programming interfaces (APIs).", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["configure_libreswan_crypto_policy", "configure_openssl_crypto_policy"], "rules": ["configure_ssh_crypto_policy", "sshd_use_approved_ciphers", "configure_crypto_policy", "sshd_use_approved_macs", "sshd_use_strong_kex", "var_system_crypto_policy=default_policy"], "controls": []}, {"id": "2.2", "levels": ["base"], "notes": "", "title": "System components are configured and managed securely.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["package_telnet_removed", "file_groupowner_backup_etc_shadow", "package_ftp_removed", "package_dhcp_removed", "file_permissions_cron_daily", "sshd_disable_root_login", "file_owner_cron_weekly", "file_owner_backup_etc_passwd", "sshd_set_max_sessions", "no_files_unowned_by_user", "package_ypbind_removed", "mask_nonessential_services", "file_owner_crontab", "bios_enable_execution_restrictions", "service_rsyncd_disabled", "sshd_use_approved_ciphers", "dir_perms_world_writable_sticky_bits", "file_owner_backup_etc_shadow", "no_empty_passwords_etc_shadow", "file_groupowner_cron_hourly", "sshd_use_approved_macs", "file_permissions_user_cfg", "package_tftp_removed", "sudo_custom_logfile", "file_permissions_backup_etc_group", "ensure_pam_wheel_group_empty", "file_permissions_sshd_private_key", "file_owner_backup_etc_group", "sudo_add_use_pty", "file_groupowner_cron_weekly", "configure_ssh_crypto_policy", "use_pam_wheel_group_for_su", "file_owner_etc_passwd", "file_permissions_ungroupowned", "file_groupowner_grub2_cfg", "file_groupowner_etc_group", "file_at_deny_not_exist", "package_xinetd_removed", "file_owner_at_allow", "sudo_require_reauthentication", "sshd_disable_x11_forwarding", "file_permissions_backup_etc_passwd", "file_owner_cron_daily", "file_permissions_cron_d", "package_talk_removed", "file_groupowner_backup_etc_group", "file_groupowner_etc_shadow", "package_sudo_installed", "file_permissions_cron_weekly", "file_owner_cron_allow", "package_cron_installed", "file_owner_etc_shadow", "file_permissions_cron_hourly", "file_permissions_cron_monthly", "file_owner_grub2_cfg", "sshd_limit_user_access", "file_permissions_cron_allow", "file_groupowner_crontab", "package_telnet-server_removed", "file_permissions_unauthorized_world_writable", "file_groupowner_cron_monthly", "sshd_disable_rhosts", "file_groupowner_etc_passwd", "file_owner_cron_d", "file_groupowner_cron_d", "sshd_enable_pam", "file_owner_cron_monthly", "file_owner_cron_hourly", "ensure_root_password_configured", "file_cron_deny_not_exist", "sshd_use_strong_kex", "file_groupowner_cron_allow", "sshd_disable_tcp_forwarding", "file_permissions_sshd_pub_key", "sshd_set_maxstartups", "file_permissions_backup_etc_shadow", "file_groupowner_user_cfg", "package_ypserv_removed", "sshd_set_loglevel_verbose", "file_groupowner_at_allow", "package_rsh_removed", "file_owner_user_cfg", "service_avahi-daemon_disabled", "file_groupowner_cron_daily", "file_permissions_sshd_config", "service_rpcbind_disabled", "file_permissions_at_allow", "sshd_do_not_permit_user_env", "package_tftp-server_removed", "file_permissions_etc_shadow", "sshd_set_login_grace_time", "file_permissions_etc_passwd", "package_net-snmp_removed", "package_rsh-server_removed", "install_PAE_kernel_on_x86-32", "file_permissions_crontab", "file_owner_etc_group", "file_permissions_grub2_cfg", "configure_crypto_policy", "sshd_set_max_auth_tries", "sshd_disable_empty_passwords", "file_permissions_etc_group", "sudo_require_authentication", "package_talk-server_removed", "file_groupowner_backup_etc_passwd", "var_system_crypto_policy=default_policy", "var_sshd_set_login_grace_time=60"], "controls": ["2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.2.5", "2.2.6", "2.2.7"]}, {"id": "2.3.1", "levels": ["base"], "notes": "Wireless interfaces are disabled by 1.3.3.", "title": "For wireless environments connected to the CDE or transmitting account data, all wireless vendor defaults are changed at installation or are confirmed to be secure.", "description": "For wireless environments connected to the CDE or transmitting account data, all wireless\nvendor defaults are changed at installation or are confirmed to be secure, including but\nnot limited to:\n- Default wireless encryption keys.\n- Passwords on wireless access points.\n- SNMP defaults.\n- Any other security-related wireless vendor defaults.", "rationale": null, "automated": "no", "status": "supported", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["wireless_disable_interfaces"], "rules": [], "controls": []}, {"id": "2.3.2", "levels": ["base"], "notes": "Wireless interfaces are disabled by 1.3.3.", "title": "For wireless environments connected to the CDE or transmitting account data, wireless encryption keys are changed", "description": "For wireless environments connected to the CDE or transmitting account\ndata, wireless encryption keys are changed", "rationale": null, "automated": "no", "status": "supported", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["wireless_disable_interfaces"], "rules": [], "controls": []}, {"id": "2.3", "levels": ["base"], "notes": "", "title": "Wireless environments are configured and managed securely.", "description": null, "rationale": null, "automated": "no", "status": "supported", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["2.3.1", "2.3.2"]}, {"id": "3.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 3 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 3 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 3 are documented, assigned and understood\nby the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 3 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for protecting stored account data are defined and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["3.1.1", "3.1.2"]}, {"id": "3.2.1", "levels": ["base"], "notes": "This requirement is very dependent on each site policies and business model.\nLocal policies should be consulted and audited. Manual checking is reasonable.", "title": "Account data storage is kept to a minimum through implementation of data retention and disposal policies, procedures, and processes.", "description": "Account data storage is kept to a minimum through implementation of data retention and\ndisposal policies, procedures, and processes that include at least the following:\n- Coverage for all locations of stored account data.\n- Coverage for any sensitive authentication data (SAD) stored prior to completion of\nauthorization.\n- Limiting data storage amount and retention time to that which is required for legal or\nregulatory, and/or business requirements.\n- Specific retention requirements for stored account data that defines length of retention\nperiod and includes a documented business justification.\n- Processes for secure deletion or rendering account data unrecoverable when no longer\nneeded per the retention policy.\n- A process for verifying, at least once every three months, that stored account data\nexceeding the defined retention period has been securely deleted or rendered unrecoverable.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.2", "levels": ["base"], "notes": "", "title": "Storage of account data is kept to a minimum.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["3.2.1"]}, {"id": "3.3.1.1", "levels": ["base"], "notes": "This requirement consists in auditing files, databases and memory to make sure the full\ncontent of any track is not unnecessarily stored. It involves manual auditing but some\nautomated rules fit this requirement in order to reduce the chances if this data be\nunintentionally stored in memory.", "title": "The full contents of any track are not stored upon completion of the authorization process.", "description": "This requirement is not eligible for the customized approach. In the normal course of\nbusiness, the following data elements from the track may need to be retained:\n- Cardholder name.\n- Primary account number (PAN).\n- Expiration date.\n- Service code.\nTo minimize risk, store securely only these data elements as needed for business.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["kernel_config_page_poisoning", "kernel_config_page_poisoning_no_sanity", "kernel_config_page_poisoning_zero", "sysctl_kernel_core_uses_pid"], "rules": ["sysctl_kernel_core_pattern", "sysctl_fs_suid_dumpable", "sysctl_kernel_randomize_va_space", "coredump_disable_storage", "coredump_disable_backtraces", "disable_users_coredumps"], "controls": []}, {"id": "3.3.1.2", "levels": ["base"], "notes": "Same rules already selected in 3.3.1.1 are valid here, but they are not repeated.", "title": "The card verification code is not stored upon completion of the authorization process.", "description": "This requirement is not eligible for the customized approach. The card verification code\nis the three- or four-digit number printed on the front or back of a payment card used\nto verify card-not-present transactions.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["coredump_disable_backtraces", "coredump_disable_storage", "disable_users_coredumps", "sysctl_fs_suid_dumpable"], "rules": [], "controls": []}, {"id": "3.3.1.3", "levels": ["base"], "notes": "Same rules already selected in 3.3.1.1 are valid here, but they are not repeated.", "title": "The personal identification number (PIN) and the PIN block are not stored upon completion of the authorization process.", "description": "This requirement is not eligible for the customized approach. PIN blocks are encrypted\nduring the natural course of transaction processes, but even if an entity encrypts the\nPIN block again, it is still not allowed to be stored after the completion of the\nauthorization process.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["coredump_disable_backtraces", "coredump_disable_storage", "disable_users_coredumps", "sysctl_fs_suid_dumpable"], "rules": [], "controls": []}, {"id": "3.3.1", "levels": ["base"], "notes": "", "title": "SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process.", "description": "This requirement is not eligible for the customized approach. This requirement does not\napply to issuers and companies that support issuing services (where SAD is needed for a\nlegitimate issuing business need) and have a business justification to store the sensitive\nauthentication data. Refer to Requirement 3.3.3 for additional requirements specifically\nfor issuers. Sensitive authentication data includes the data cited in Requirements 3.3.1.1\nthrough 3.3.1.3.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["sysctl_kernel_core_pattern", "sysctl_fs_suid_dumpable", "sysctl_kernel_randomize_va_space", "coredump_disable_storage", "coredump_disable_backtraces", "disable_users_coredumps"], "controls": ["3.3.1.1", "3.3.1.2", "3.3.1.3"]}, {"id": "3.3.2", "levels": ["base"], "notes": "This requirement is a best practice until 31 March 2025, after which it will be required\nand must be fully considered during a PCI DSS assessment.\nThis requirement consists of auditing information stored during a relatively short period\nof time. Where and how the information is possibly stored depends in each Business and\nlocal policies so the check is not actually automatable.", "title": "SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.", "description": "This requirement is not eligible for the customized approach. Whether SAD is permitted to\nbe stored prior to authorization is determined by the organizations that manage compliance\nprograms (for example, payment brands and acquirers). Contact the organizations of\ninterest for any additional criteria. This requirement applies to all storage of SAD, even\nif no PAN is present in the environment. Refer to Requirement 3.2.1 for an additional\nrequirement that applies if SAD is stored prior to completion of authorization. Issuers\nand companies that support issuing services, where there is a legitimate and documented\nbusiness need to store SAD, are not required to meet this requirement. A legitimate\nbusiness need is one that is necessary for the performance of the function being provided\nby or for the issuer. Refer to Requirement 3.3.3 for requirements specifically for issuers.\nThis requirement does not replace how PIN blocks are required to be managed, nor does it\nmean that a properly encrypted PIN block needs to be encrypted again.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.3.3", "levels": ["base"], "notes": "", "title": "Additional requirement for issuers and companies that support issuing services and store sensitive authentication data.", "description": "Additional requirement for issuers and companies that support issuing services and store\nsensitive authentication data: Any storage of sensitive authentication data is:\n- Limited to that which is needed for a legitimate issuing business need and is secured.\n- Encrypted using strong cryptography. This bullet is a best practice until until\n31 March 2025, after which it will be required as part of Requirement 3.3.3 and must be\nfully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.3", "levels": ["base"], "notes": "", "title": "Sensitive authentication data (SAD) is not stored after authorization.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["sysctl_kernel_core_pattern", "sysctl_fs_suid_dumpable", "sysctl_kernel_randomize_va_space", "coredump_disable_storage", "coredump_disable_backtraces", "disable_users_coredumps"], "controls": ["3.3.1.1", "3.3.1.2", "3.3.1.3", "3.3.1", "3.3.2", "3.3.3"]}, {"id": "3.4.1", "levels": ["base"], "notes": "Consists on examining documented policies and procedures, checking system configurations\nand observing relevant applications.", "title": "PAN is masked when displayed (the BIN and last four digits are the maximum number of digits to be displayed), such that only personnel with a legitimate business need can see more than the BIN and last four digits of the PAN.", "description": "PAN displays are restricted to the minimum number of digits necessary to meet a defined\nbusiness need. This requirement does not supersede stricter requirements in place for\ndisplays of cardholder data \u2014 for example, legal or payment brand requirements for\npoint-of-sale (POS) receipts. This requirement relates to protection of PAN where it is\ndisplayed on screens, paper receipts, printouts, etc., and is not to be confused with\nRequirement 3.5.1 for protection of PAN when stored, processed, or transmitted.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.4.2", "levels": ["base"], "notes": "There are technical rules to disable removable storage devices. However, this requirement\nstill demand some manual auditing in documentation and eventual exceptions.", "title": "When using remote-access technologies, technical controls prevent copy and/or relocation of PAN for all personnel, except for those with documented, explicit authorization and a legitimate, defined business need.", "description": "PAN cannot be copied or relocated by unauthorized personnel using remote-access\ntechnologies. Storing or relocating PAN onto local hard drives, removable electronic\nmedia, and other storage devices brings these devices into scope for PCI DSS.\nThis requirement is a best practice until 31 March 2025, after which it will be required\nand must be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["kernel_module_usb-storage_disabled", "dconf_gnome_disable_automount", "dconf_gnome_disable_automount_open"], "controls": []}, {"id": "3.4", "levels": ["base"], "notes": "", "title": "Access to displays of full PAN and ability to copy PAN is restricted.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["kernel_module_usb-storage_disabled", "dconf_gnome_disable_automount", "dconf_gnome_disable_automount_open"], "controls": ["3.4.1", "3.4.2"]}, {"id": "3.5.1.1", "levels": ["base"], "notes": "This requirement likely demand assessment in application level for some environments and\nthis would be too specific to be automated. However, on system level we can ensure some\nstrong cryptographic algorithms. This is also generally covered by 2.2.7 but here would\nbe possible to include more specific rules, for openssl and libreswan for example.\nHowever it would be first necessary to include a platform conditional in these rules\nbefore selecting them so they are applicable only if the respective packages are\ninstalled.", "title": "Hashes used to render PAN unreadable (per the first bullet of Requirement 3.5.1) are keyed cryptographic hashes of the entire PAN, with associated key-management processes and procedures in accordance with Requirements 3.6 and 3.7.", "description": "All Applicability Notes for Requirement 3.5.1 also apply to this requirement.\nKey-management processes and procedures (Requirements 3.6 and 3.7) do not apply to\nsystem components used to generate individual keyed hashes of a PAN for comparison to\nanother system if:\n- The system components only have access to one hash value at a time (hash values are\nnot stored on the system)\nAND\n- There is no other account data stored on the same system as the hashes.\nThis requirement is considered a best practice until 31 March 2025, after which it will\nbe required and must be fully considered during a PCI DSS assessment. This requirement\nwill replace the bullet in Requirement 3.5.1 for one-way hashes once its effective date\nis reached.", "rationale": null, "automated": "no", "status": "planned", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["configure_libreswan_crypto_policy", "configure_openssl_crypto_policy"], "rules": [], "controls": []}, {"id": "3.5.1.2", "levels": ["base"], "notes": "", "title": "If disk-level or partition-level encryption (rather than file-, column-, or field-level database encryption) is used to render PAN unreadable, it is implemented only on removable electronic media or complemented by another mechanism that meets Requirement 3.5.1", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["package_cryptsetup-luks_installed"], "controls": []}, {"id": "3.5.1.3", "levels": ["base"], "notes": "To properly check this requirement, site policies and documentation should be consulted.", "title": "If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable, it is managed.", "description": "If disk-level or partition-level encryption is used (rather than file-, column-, or\nfield--level database encryption) to render PAN unreadable, it is managed as follows:\n- Logical access is managed separately and independently of native operating system\nauthentication and access control mechanisms.\n- Decryption keys are not associated with user accounts.\n- Authentication factors (passwords, passphrases, or cryptographic keys) that allow\naccess to unencrypted data are stored securely.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.5.1", "levels": ["base"], "notes": "", "title": "PAN is rendered unreadable anywhere it is stored", "description": "PAN is rendered unreadable anywhere it is stored by using any of the following approaches:\n- One-way hashes based on strong cryptography of the entire PAN.\n- Truncation (hashing cannot be used to replace the truncated segment of PAN).\n  - If hashed and truncated versions of the same PAN, or different truncation formats of\n  the same PAN, are present in an environment, additional controls are in place such that\n  the different versions cannot be correlated to reconstruct the original PAN.\n- Indexes tokens.\n- Strong cryptography with associated key-management processes and procedures.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["package_cryptsetup-luks_installed"], "controls": ["3.5.1.1", "3.5.1.2", "3.5.1.3"]}, {"id": "3.5", "levels": ["base"], "notes": "", "title": "Primary account number (PAN) is secured wherever it is stored.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["package_cryptsetup-luks_installed"], "controls": ["3.5.1.1", "3.5.1.2", "3.5.1.3", "3.5.1"]}, {"id": "3.6.1.1", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: A documented description of the cryptographic architecture is maintained", "description": "Additional requirement for service providers only: A documented description of the\ncryptographic architecture is maintained that includes:\n- Details of all algorithms, protocols, and keys used for the protection of stored\naccount data, including key strength and expiry date.\n- Preventing the use of the same cryptographic keys in production and test environments.\nThis bullet is a best practice until 31 March 2025, after which it will be required as\npart of Requirement 3.6.1.1 and must be fully considered during a PCI DSS assessment.\n- Description of the key usage for each key.\n- Inventory of any hardware security modules (HSMs), key management systems (KMS), and\nother secure cryptographic devices (SCDs) used for key management, including type and\nlocation of devices, as outlined in Requirement 12.3.4.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.6.1.2", "levels": ["base"], "notes": "", "title": "Secret and private keys used to encrypt/decrypt stored account data are stored in secure forms.", "description": "Secret and private keys used to encrypt/decrypt stored account data are stored in one\n(or more) of the following forms at all times:\n- Encrypted with a key-encrypting key that is at least as strong as the data-encrypting\nkey, and that is stored separately from the data-encrypting key.\n- Within a secure cryptographic device (SCD), such as a hardware security module (HSM)\nor PTS-approved point-of-interaction device.\n- As at least two full-length key components or key shares, in accordance with an\nindustry-accepted method.\nSecret and private keys are stored in a secure form that prevents unauthorized retrieval\nor access. It is not required that public keys be stored in one of these forms.\nCryptographic keys stored as part of a key management system (KMS) that employs SCDs are\nacceptable. A cryptographic key that is split into two parts does not meet this\nrequirement. Secret or private keys stored as key components or key shares must be\ngenerated via one of the following", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.6.1.3", "levels": ["base"], "notes": "", "title": "Access to cleartext cryptographic key components is restricted to the fewest number of custodians necessary.", "description": "Access to cleartext cryptographic key components is restricted to necessary personnel.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.6.1.4", "levels": ["base"], "notes": "", "title": "Cryptographic keys are stored in the fewest possible locations.", "description": "Cryptographic keys are retained only where necessary.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.6.1", "levels": ["base"], "notes": "", "title": "Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse.", "description": "Procedures are defined and implemented to protect cryptographic keys used to protect\nstored account data against disclosure and misuse that include:\n- Access to keys is restricted to the fewest number of custodians necessary.\n- Key-encrypting keys are at least as strong as the data-encrypting keys they protect.\n- Key-encrypting keys are stored separately from data-encrypting keys.\n- Keys are stored securely in the fewest possible locations and forms.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["3.6.1.1", "3.6.1.2", "3.6.1.3", "3.6.1.4"]}, {"id": "3.6", "levels": ["base"], "notes": "", "title": "Cryptographic keys used to protect stored account data are secured.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["3.6.1.1", "3.6.1.2", "3.6.1.3", "3.6.1.4", "3.6.1"]}, {"id": "3.7.1", "levels": ["base"], "notes": "", "title": "Key-management policies and procedures are implemented to include generation of strong cryptographic keys used to protect stored account data.", "description": "Strong cryptographic keys are generated.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.7.2", "levels": ["base"], "notes": "", "title": "Key-management policies and procedures are implemented to include secure distribution of cryptographic keys used to protect stored account data.", "description": "Cryptographic keys are secured during distribution.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.7.3", "levels": ["base"], "notes": "The scope of this requirement seems much wider going even to application level, which\nmight be different for each site. Regarding local system there are some technical measures\nensured by 2.2.6.", "title": "Key-management policies and procedures are implemented to include secure storage of cryptographic keys used to protect stored account data.", "description": "Cryptographic keys are secured when stored.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.7.4", "levels": ["base"], "notes": "", "title": "Key management policies and procedures are implemented for cryptographic key changes for keys that have reached the end of their cryptoperiod, as defined by the associated application vendor or key owner, and based on industry best practices and guidelines.", "description": "Key management policies and procedures are implemented for cryptographic key changes for\nkeys that have reached the end of their cryptoperiod, as defined by the associated\napplication vendor or key owner, and based on industry best practices and guidelines,\nincluding the following:\n- A defined cryptoperiod for each key type in use.\n- A process for key changes at the end of the defined cryptoperiod.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.7.5", "levels": ["base"], "notes": "", "title": "Key management policies procedures are implemented to include the retirement, replacement, or destruction of keys used to protect stored account data, as deemed necessary.", "description": "Key management policies procedures are implemented to include the retirement, replacement,\nor destruction of keys used to protect stored account data, as deemed necessary when:\n- The key has reached the end of its defined cryptoperiod.\n- The integrity of the key has been weakened, including when personnel with knowledge of a\ncleartext key component leaves the company, or the role for which the key component was\nknown.\n- The key is suspected of or known to be compromised.\n- Retired or replaced keys are not used for encryption operations.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.7.6", "levels": ["base"], "notes": "", "title": "Where manual cleartext cryptographic key-management operations are performed by personnel, key-management policies and procedures are implemented include managing these operations using split knowledge and dual control.", "description": "Cleartext secret or private keys cannot be known by anyone. Operations involving cleartext\nkeys cannot be carried out by a single person. This control is applicable for manual\nkey-management operations or where key management is not controlled by the encryption\nproduct. A cryptographic key that is simply split into two parts does not meet this\nrequirement. Secret or private keys stored as key components or key shares must be\ngenerated via one of the following", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.7.7", "levels": ["base"], "notes": "", "title": "Key management policies and procedures are implemented to include the prevention of unauthorized substitution of cryptographic keys.", "description": "Cryptographic keys cannot be substituted by unauthorized personnel.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.7.8", "levels": ["base"], "notes": "", "title": "Key management policies and procedures are implemented to include that cryptographic key custodians formally acknowledge (in writing or electronically) that they understand and accept their key-custodian responsibilities.", "description": "Key custodians are knowledgeable about their responsibilities in relation to cryptographic\noperations and can access assistance and guidance when required.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.7.9", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: Where a service provider shares cryptographic keys with its customers for transmission or storage of account data, guidance on secure transmission, storage and updating of such keys is documented and distributed to the service provider\u2019s customers.", "description": "Customers are provided with appropriate key management guidance whenever they receive\nshared cryptographic keys. This requirement applies only when the entity being assessed is\na service provider.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "3.7", "levels": ["base"], "notes": "", "title": "Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["3.7.1", "3.7.2", "3.7.3", "3.7.4", "3.7.5", "3.7.6", "3.7.7", "3.7.8", "3.7.9"]}, {"id": "4.1.1", "levels": ["base"], "notes": "", "title": "All security policies and operational procedures that are identified in Requirement 4 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "4.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 4 are documented, assigned and understood\nby the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 4 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "4.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks are defined and documented.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["4.1.1", "4.1.2"]}, {"id": "4.2.1.1", "levels": ["base"], "notes": "", "title": "An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained.", "description": "All keys and certificates used to protect PAN during transmission are identified and\nconfirmed as trusted. This requirement is a best practice until 31 March 2025, after\nwhich it will be required and must be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "4.2.1.2", "levels": ["base"], "notes": "Wireless interfaces are disabled by 1.3.3.", "title": "Wireless networks transmitting PAN or connected to the CDE use industry best practices to implement strong cryptography for authentication and transmission.", "description": "Cleartext PAN cannot be read or intercepted from wireless network transmissions.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["wireless_disable_interfaces"], "rules": [], "controls": []}, {"id": "4.2.1", "levels": ["base"], "notes": "", "title": "Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks.", "description": "Strong cryptography and security protocols are implemented as follows to safeguard PAN\nduring transmission over open, public networks:\n- Only trusted keys and certificates are accepted.\n- Certificates used to safeguard PAN during transmission over open, public networks are\nconfirmed as valid and are not expired or revoked. This bullet is a best practice until\n31 March 2025, after which it will be required as part of Requirement 4.2.1 and must be\nfully considered during a PCI DSS assessment.\n- The protocol in use supports only secure versions or configurations and does not support\nfallback to, or use of insecure versions, algorithms, key sizes, or implementations.\n- The encryption strength is appropriate for the encryption methodology in use.", "rationale": null, "automated": "no", "status": "supported", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["package_strongswan_installed", "package_libreswan_installed"], "rules": [], "controls": ["4.2.1.1", "4.2.1.2"]}, {"id": "4.2.2", "levels": ["base"], "notes": "Some known insecure services and protocols are disabled by 2.2.4.\nIf any specific end-user messaging technology is used, it should be manually checked in\nalignment to site policies.", "title": "PAN is secured with strong cryptography whenever it is sent via end-user messaging technologies.", "description": "Cleartext PAN cannot be read or intercepted from transmissions using end-user messaging\ntechnologies. This requirement also applies if a customer, or other third-party, requests\nthat PAN is sent to them via end-user messaging technologies. There could be occurrences\nwhere an entity receives unsolicited cardholder data via an insecure communication channel\nthat was not intended for transmissions of sensitive data. In this situation, the entity\ncan choose to either include the channel in the scope of their CDE and secure it according\nto PCI DSS or delete the cardholder data and implement measures to prevent the channel\nfrom being used for cardholder data.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "4.2", "levels": ["base"], "notes": "", "title": "PAN is protected with strong cryptography during transmission.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["4.2.1.1", "4.2.1.2", "4.2.1", "4.2.2"]}, {"id": "5.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 5 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 5 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 5 are documented, assigned and understood\nby the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 5 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for protecting all systems and networks from malicious software are defined and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["5.1.1", "5.1.2"]}, {"id": "5.2.1", "levels": ["base"], "notes": "There are many options of anti-malware and the criteria for any adopted solution or\napproach relies on each site policy. Technologies are supported but manual assessment is\nrequired.", "title": "An anti-malware solution(s) is deployed on all system components, except for those system components identified in periodic evaluations per Requirement 5.2.3 that concludes the system components are not at risk from malware.", "description": "Automated mechanisms are implemented to prevent systems from becoming an attack vector for\nmalware.", "rationale": null, "automated": "no", "status": "supported", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.2.2", "levels": ["base"], "notes": "", "title": "The deployed anti-malware solution(s) detects all known types of malware and removes, blocks, or contains all known types of malware.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.2.3.1", "levels": ["base"], "notes": "", "title": "The frequency of periodic evaluations of system components identified as not at risk for malware is defined in the entity's targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1.", "description": "Systems not known to be at risk from malware are re-evaluated at a frequency that\naddresses the entity's risk. This requirement is a best practice until 31 March 2025,\nafter which it will be required and must be fully considered during a PCI DSS\nassessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.2.3", "levels": ["base"], "notes": "", "title": "Any system components that are not at risk for malware are evaluated periodically.", "description": "Any system components that are not at risk for malware are evaluated periodically to\ninclude the following:\n- A documented list of all system components not at risk for malware.\n- Identification and evaluation of evolving malware threats for those system components.\n- Confirmation whether such system components continue to not require anti-malware\nprotection.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["5.2.3.1"]}, {"id": "5.2", "levels": ["base"], "notes": "Related measures are covered by 1.2.6, 1.4.5 and 3.4.2.", "title": "Malicious software (malware) is prevented, or detected and addressed.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["5.2.1", "5.2.2", "5.2.3.1", "5.2.3"]}, {"id": "5.3.1", "levels": ["base"], "notes": "", "title": "The anti-malware solution(s) is kept current via automatic updates.", "description": "Anti-malware mechanisms can detect and address the latest malware threats.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.3.2.1", "levels": ["base"], "notes": "", "title": "If periodic malware scans are performed to meet Requirement 5.3.2, the frequency of scans is defined in the entity's targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1.", "description": "Scans by the malware solution are performed at a frequency that addresses the entity's\nrisk. This requirement applies to entities conducting periodic malware scans to meet\nRequirement 5.3.2. This requirement is a best practice until 31 March 2025, after which\nit will be required and must be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.3.2", "levels": ["base"], "notes": "", "title": "The anti-malware solution(s) performs periodic scans and active or real-time scans or performs continuous behavioral analysis of systems or processes.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["5.3.2.1"]}, {"id": "5.3.3", "levels": ["base"], "notes": "Related measures are covered by 3.4.2.", "title": "For removable electronic media, the anti-malware solution(s) performs automatic scans of when the media is inserted, connected, or logically mounted, or Performs continuous behavioral analysis of systems or processes when the media is inserted, connected, or logically mounted.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.3.4", "levels": ["base"], "notes": "", "title": "Audit logs for the anti-malware solution(s) are enabled and retained in accordance with Requirement 10.5.1.", "description": "Historical records of anti-malware actions are immediately available and retained for at\nleast 12 months.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.3.5", "levels": ["base"], "notes": "Related measures are covered by 2.2.6 requirement and 8.2 section.", "title": "Anti-malware mechanisms cannot be disabled or altered by users, unless specifically documented, and authorized by management on a case-by-case basis for a limited time period.", "description": "Anti-malware mechanisms cannot be modified by unauthorized personnel.Anti-malware\nsolutions may be temporarily disabled only if there is a legitimate technical need, as\nauthorized by management on a case-by-case basis. If anti-malware protection needs to be\ndisabled for a specific purpose, it must be formally authorized. Additional security\nmeasures may also need to be implemented for the period during which anti-malware\nprotection is not active.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.3", "levels": ["base"], "notes": "", "title": "Anti-malware mechanisms and processes are active, maintained, and monitored.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["5.3.1", "5.3.2.1", "5.3.2", "5.3.3", "5.3.4", "5.3.5"]}, {"id": "5.4.1", "levels": ["base"], "notes": "", "title": "Processes and automated mechanisms are in place to detect and protect personnel against phishing attacks.", "description": "Mechanisms are in place to protect against and mitigate risk posed by phishing attacks.\nThe focus of this requirement is on protecting personnel with access to system components\nin-scope for PCI DSS. Meeting this requirement for technical and automated controls to\ndetect and protect personnel against phishing is not the same as Requirement 12.6.3.1 for\nsecurity awareness training. Meeting this requirement does not also meet the requirement\nfor providing personnel with security awareness training, and vice versa. This requirement\nis a best practice until 31 March 2025, after which it will be required and must be fully\nconsidered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "5.4", "levels": ["base"], "notes": "", "title": "Anti-phishing mechanisms protect users against phishing attacks.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["5.4.1"]}, {"id": "6.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 6 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 6 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 6 are documented, assigned and understood\nby the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 6 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for developing and maintaining secure systems and software are defined and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["6.1.1", "6.1.2"]}, {"id": "6.2.1", "levels": ["base"], "notes": "", "title": "Bespoke and custom software are developed securely.", "description": "Bespoke and custom software are developed securely, as follows:\n- Based on industry standards and/or best practices for secure development.\n- In accordance with PCI DSS (for example, secure authentication and logging).\n- Incorporating consideration of information security issues during each stage of the\nsoftware development lifecycle.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.2.2", "levels": ["base"], "notes": "", "title": "Software development personnel working on bespoke and custom software are trained at least once every 12 months", "description": "Software development personnel working on bespoke and custom software are trained at least\nonce every 12 months as follows:\n- On software security relevant to their job function and development languages.\n- Including secure software design and secure coding techniques.\n- Including, if security testing tools are used, how to use the tools for detecting\nvulnerabilities in software.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.2.3.1", "levels": ["base"], "notes": "", "title": "If manual code reviews are performed for bespoke and custom software prior to release to production code changes co-reviewed and approved.", "description": "If manual code reviews are performed for bespoke and custom software prior to release\nto production code changes are:\n- Reviewed by individuals other than the originating code author, and who are\nknowledgeable about code-review techniques and secure coding practices.\n- Reviewed and approved by management prior to release.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.2.3", "levels": ["base"], "notes": "", "title": "Bespoke and custom software is reviewed prior to being released into production or to customers, to identify and correct potential coding vulnerabilities.", "description": "Bespoke and custom software is reviewed prior to being released into production or to\ncustomers, to identify and correct potential coding vulnerabilities, as follows:\n- Code reviews ensure code is developed according to secure coding guidelines.\n- Code reviews look for both existing and emerging software vulnerabilities.\n- Appropriate corrections are implemented prior to release.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["6.2.3.1"]}, {"id": "6.2.4", "levels": ["base"], "notes": "", "title": "Software engineering techniques or other methods are defined and in use by software development personnel to prevent or mitigate common software attacks and related vulnerabilities in bespoke and custom software.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.2", "levels": ["base"], "notes": "", "title": "Bespoke and custom software are developed securely.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["6.2.1", "6.2.2", "6.2.3.1", "6.2.3", "6.2.4"]}, {"id": "6.3.1", "levels": ["base"], "notes": "", "title": "Security vulnerabilities are identified and managed", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.3.2", "levels": ["base"], "notes": "This requirement is a best practice until 31 March 2025, after which it will be required\nand must be fully considered during a PCI DSS assessment.", "title": "An inventory of bespoke and custom software, and third-party software components incorporated into bespoke and custom software is maintained to facilitate vulnerability and patch management.", "description": "Known vulnerabilities in third-party software components cannot be exploited in bespoke\nand custom software.This requirement is a best practice until 31 March 2025, after which\nit will be required and must be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.3.3", "levels": ["base"], "notes": "", "title": "All system components are protected from known vulnerabilities by installing applicable security patches/updates.", "description": "All system components are protected from known vulnerabilities by installing\napplicable security patches/updates as follows:\n- Patches/updates for critical vulnerabilities (identified according to the risk ranking\nprocess at Requirement 6.3.1) are installed within one month of release.\n- All other applicable security patches/updates are installed within an appropriate time\nframe as determined by the entity's assessment of the criticality of the risk to the\nenvironment as identified according to the risk ranking process at Requirement 6.3.1.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["ensure_gpgcheck_globally_activated", "security_patches_up_to_date", "ensure_almalinux_gpgkey_installed", "ensure_gpgcheck_never_disabled", "ensure_suse_gpgkey_installed", "ensure_redhat_gpgkey_installed"], "controls": []}, {"id": "6.3", "levels": ["base"], "notes": "", "title": "Security vulnerabilities are identified and addressed.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["ensure_gpgcheck_globally_activated", "security_patches_up_to_date", "ensure_almalinux_gpgkey_installed", "ensure_gpgcheck_never_disabled", "ensure_suse_gpgkey_installed", "ensure_redhat_gpgkey_installed"], "controls": ["6.3.1", "6.3.2", "6.3.3"]}, {"id": "6.4.1", "levels": ["base"], "notes": "", "title": "For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks.", "description": "For public-facing web applications, new threats and vulnerabilities are addressed on an\nongoing basis and these applications are protected against known attacks as follows:\n- Reviewing public-facing web applications via manual or automated application\nvulnerability security assessment tools or methods as follows:\n  - At least once every 12 months and after significant changes.\n  - By an entity that specializes in application security.\n  - Including, at a minimum, all common software attacks in Requirement 6.2.4.\n  - All vulnerabilities are ranked in accordance with requirement 6.3.1.\n  - All vulnerabilities are corrected.\n  - The application is re-evaluated after the corrections\nOR\n- Installing an automated technical solution(s) that continually detects and prevents\nweb-based attacks as follows:\n  - Installed in front of public-facing web applications to detect and prevent web-based\n  attacks.\n  - Actively running and up to date as applicable.\n  - Generating audit logs.\n  - Configured to either block web-based attacks or generate an alert that is immediately\n  investigated.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.4.2", "levels": ["base"], "notes": "", "title": "For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.4.3", "levels": ["base"], "notes": "", "title": "All payment page scripts that are loaded and executed in the consumer's browser are managed", "description": "All payment page scripts that are loaded and executed in the consumer's browser are\nmanaged as follows:\n- A method is implemented to confirm that each script is authorized.\n- A method is implemented to assure the integrity of each script.\n- An inventory of all scripts is maintained with written business or technical\njustification as to why each is necessary.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.4", "levels": ["base"], "notes": "", "title": "Public-facing web applications are protected against attacks.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["6.4.1", "6.4.2", "6.4.3"]}, {"id": "6.5.1", "levels": ["base"], "notes": "", "title": "Changes to all system components in the production environment are made according to established procedures.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.5.2", "levels": ["base"], "notes": "", "title": "Upon completion of a significant change, all applicable PCI DSS requirements are confirmed to be in place on all new or changed systems and networks, and documentation is updated as applicable.", "description": "All system components are verified after a significant change to be compliant with the\napplicable PCI DSS requirements.These significant changes should also be captured and\nreflected in the entity's annual PCI DSS scope confirmation activity per Requirement\n12.5.2.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.5.3", "levels": ["base"], "notes": "", "title": "Pre-production environments are separated from production environments and the separation is enforced with access controls.", "description": "Pre-production environments cannot introduce risks and vulnerabilities into production\nenvironments.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.5.4", "levels": ["base"], "notes": "", "title": "Roles and functions are separated between production and pre-production environments to provide accountability such that only reviewed and approved changes are deployed.", "description": "Job roles and accountability that differentiate between pre-production and production\nactivities are defined and managed to minimize the risk of unauthorized, unintentional,\nor inappropriate actions. In environments with limited personnel where individuals perform\nmultiple roles or functions, this same goal can be achieved with additional procedural\ncontrols that provide accountability. For example, a developer may also be an administrator\nthat uses an administrator-level account with elevated privileges in the development\nenvironment and, for their developer role, they use a separate account with user-level\naccess to the production environment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.5.5", "levels": ["base"], "notes": "", "title": "Live PANs are not used in pre-production environments, except where those environments are included in the CDE and protected in accordance with all applicable PCI DSS requirements.", "description": "Live PANs cannot be present in pre-production environments outside the CDE.s", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.5.6", "levels": ["base"], "notes": "", "title": "Test data and test accounts are removed from system components before the system goes into production.", "description": "Test data and test accounts cannot exist in production environments.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "6.5", "levels": ["base"], "notes": "", "title": "Changes to all system components are managed securely.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["6.5.1", "6.5.2", "6.5.3", "6.5.4", "6.5.5", "6.5.6"]}, {"id": "7.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 7 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 7 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 7 are documented, assigned and understood\nby the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 7 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["7.1.1", "7.1.2"]}, {"id": "7.2.1", "levels": ["base"], "notes": "General access are restricted by 2.2.6 and 8.2 section. This requirement is more about\nchecking granting access process.", "title": "An access control model is defined and includes granting access", "description": "An access control model is defined and includes granting access as follows:\n- Appropriate access depending on the entity's business and access needs.\n- Access to system components and data resources that is based on users' job\nclassification and functions.\n- The least privileges required (for example, user, administrator) to perform a job\nfunction.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.2.2", "levels": ["base"], "notes": "", "title": "Access is assigned to users, including privileged users, based on job classification and function, and least privileges necessary to perform job responsibilities.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.2.3", "levels": ["base"], "notes": "", "title": "Required privileges are approved by authorized personnel.", "description": "Access privileges cannot be granted to users without appropriate, documented\nauthorization.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.2.4", "levels": ["base"], "notes": "", "title": "All user accounts and related access privileges, including third-party/vendor accounts, are reviewed", "description": "All user accounts and related access privileges, including third-party/vendor accounts,\nare reviewed as follows:\n- At least once every six months.\n- To ensure user accounts and access remain appropriate based on job function.\n- Any inappropriate access is addressed.\n- Management acknowledges that access remains appropriate.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.2.5.1", "levels": ["base"], "notes": "", "title": "All access by application and system accounts and related access privileges are reviewed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.2.5", "levels": ["base"], "notes": "General access are restricted by 2.2.6 and 8.2 section.", "title": "All application and system accounts and related access privileges are assigned and managed.", "description": "All application and system accounts and related access privileges are assigned and managed\nas follows:\n- Based on the least privileges necessary for the operability of the system or application.\n- Access is limited to the systems, applications, or processes that specifically require\ntheir use.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["7.2.5.1"]}, {"id": "7.2.6", "levels": ["base"], "notes": "This requirement is specific about cardholder data, which can be available in different\nformats, such as clear and binary files, and databases depending on site policies.\nGeneral system restrictions are covered in 2.2.6.", "title": "All user access to query repositories of stored cardholder data is restricted", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.2", "levels": ["base"], "notes": "", "title": "Access to system components and data is appropriately defined and assigned.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["7.2.1", "7.2.2", "7.2.3", "7.2.4", "7.2.5.1", "7.2.5", "7.2.6"]}, {"id": "7.3.1", "levels": ["base"], "notes": "", "title": "An access control system(s) is in place that restricts access based on a user's need to know and covers all system components.", "description": "Access rights and privileges are managed via mechanisms intended for that purpose.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.3.2", "levels": ["base"], "notes": "", "title": "The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function.", "description": "Individual account access rights and privileges to systems, applications, and data are\nonly inherited from group membership.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.3.3", "levels": ["base"], "notes": "It is possible we can select some rules for this requirement but more investigation is\nneeded to confirm.", "title": "The access control system(s) is set to \"deny all\" by default.", "description": "Access rights and privileges are prohibited unless expressly permitted.", "rationale": null, "automated": "no", "status": "planned", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "7.3", "levels": ["base"], "notes": "", "title": "Access to system components and data is managed via an access control system(s).", "description": null, "rationale": null, "automated": "no", "status": "planned", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["7.3.1", "7.3.2", "7.3.3"]}, {"id": "8.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 8 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 8 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 8 are documented, assigned and understood\nby the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 8 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for identifying users and authenticating access to system components are defined and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["8.1.1", "8.1.2"]}, {"id": "8.2.1", "levels": ["base"], "notes": "The rules selected in this requirement are incomplete. Missing remediation and test\nscenarios. They should include test scenarios and likely remediation or a warning\ninforming why a remediation is not present.", "title": "All users are assigned a unique ID before access to system components or cardholder data is allowed.", "description": "All actions by all users are attributable to an individual. This requirement is not\nintended to apply to user accounts within point-of-sale terminals that have access to only\none card number at a time to facilitate a single transaction (such as IDs used by cashiers\non point-of-sale terminals).", "rationale": null, "automated": "no", "status": "planned", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["account_unique_id", "account_unique_name", "group_unique_id", "accounts_root_gid_zero", "group_unique_name", "accounts_no_uid_except_zero"], "controls": []}, {"id": "8.2.2", "levels": ["base"], "notes": "This requirement is complemented by 8.2.1 and related to 8.3.5.", "title": "Group, shared, or generic IDs, or other shared authentication credentials are only used when necessary on an exception basis, and are managed.", "description": "- ID use is prevented unless needed for an exceptional circumstance.\n- Use is limited to the time needed for the exceptional circumstance.\n- Business justification for use is documented.\n- Use is explicitly approved by management.\n- Individual user identity is confirmed before access to an account is granted.\n- Every action taken is attributable to an individual user.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["no_password_auth_for_systemaccounts", "no_shelllogin_for_systemaccounts", "gid_passwd_group_same"], "controls": []}, {"id": "8.2.3", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: Service providers with remote access to customer premises use unique authentication factors for each customer premises.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.2.4", "levels": ["base"], "notes": "", "title": "Addition, deletion, and modification of user IDs, authentication factors, and other identifier objects are managed", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.2.5", "levels": ["base"], "notes": "This requirement depends on site policies for user termination.", "title": "Access for terminated users is immediately revoked.", "description": "The accounts of terminated users cannot be used.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.2.6", "levels": ["base"], "notes": "Also related to requirements 2.2.2 and 8.3.5.", "title": "Inactive user accounts are removed or disabled within 90 days of inactivity.", "description": "Inactive user accounts cannot be used.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["accounts_set_post_pw_existing", "account_disable_post_pw_expiration", "var_account_disable_post_pw_expiration=90"], "controls": []}, {"id": "8.2.7", "levels": ["base"], "notes": "", "title": "Accounts used by third parties to access, support, or maintain system components via remote access are managed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.2.8", "levels": ["base"], "notes": "", "title": "If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session.", "description": "A user session cannot be used except by the authorized user. This requirement is not\nintended to apply to user accounts on point-of-sale terminals that have access to only one\ncard number at a time to facilitate a single transaction (such as IDs used by cashiers on\npoint-of-sale terminals). This requirement is not meant to prevent legitimate activities\nfrom being performed while the console/PC is unattended.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["sshd_set_keepalive_0"], "rules": ["dconf_gnome_screensaver_idle_activation_enabled", "dconf_gnome_screensaver_idle_delay", "sshd_set_keepalive", "dconf_db_up_to_date", "dconf_gnome_screensaver_lock_enabled", "enable_dconf_user_profile", "dconf_gnome_screensaver_lock_delay", "sshd_set_idle_timeout", "dconf_gnome_session_idle_user_locks", "dconf_gnome_screensaver_mode_blank", "inactivity_timeout_value=15_minutes", "var_screensaver_lock_delay=10_seconds", "sshd_idle_timeout_value=15_minutes", "var_sshd_set_keepalive=1"], "controls": []}, {"id": "8.2", "levels": ["base"], "notes": "", "title": "User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["dconf_gnome_screensaver_idle_activation_enabled", "account_disable_post_pw_expiration", "dconf_db_up_to_date", "account_unique_name", "no_shelllogin_for_systemaccounts", "accounts_set_post_pw_existing", "no_password_auth_for_systemaccounts", "dconf_gnome_screensaver_idle_delay", "sshd_set_keepalive", "enable_dconf_user_profile", "group_unique_id", "accounts_root_gid_zero", "group_unique_name", "dconf_gnome_screensaver_lock_enabled", "account_unique_id", "dconf_gnome_screensaver_lock_delay", "sshd_set_idle_timeout", "dconf_gnome_session_idle_user_locks", "dconf_gnome_screensaver_mode_blank", "gid_passwd_group_same", "accounts_no_uid_except_zero", "inactivity_timeout_value=15_minutes", "var_screensaver_lock_delay=10_seconds", "sshd_idle_timeout_value=15_minutes", "var_sshd_set_keepalive=1", "var_account_disable_post_pw_expiration=90"], "controls": ["8.2.1", "8.2.2", "8.2.3", "8.2.4", "8.2.5", "8.2.6", "8.2.7", "8.2.8"]}, {"id": "8.3.1", "levels": ["base"], "notes": "", "title": "All user access to system components for users and administrators is authenticated.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["no_empty_passwords", "disable_host_auth", "gnome_gdm_disable_automatic_login", "gnome_gdm_disable_unattended_automatic_login", "gnome_gdm_disable_guest_login"], "controls": []}, {"id": "8.3.2", "levels": ["base"], "notes": "There are similar rules that might be redundant for some distros.", "title": "Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components.", "description": "Cleartext authentication factors cannot be obtained, derived, or reused from the\ninterception of communications or from stored data.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["set_password_hashing_algorithm_logindefs", "set_password_hashing_algorithm_libuserconf", "set_password_hashing_algorithm_systemauth", "ensure_shadow_group_empty", "set_password_hashing_algorithm_commonauth", "accounts_password_all_shadowed", "var_password_hashing_algorithm=SHA512", "var_password_hashing_algorithm_pam=sha512"], "controls": []}, {"id": "8.3.3", "levels": ["base"], "notes": "This requirement is about processes, such as password resets, provisioning new hardware or\nsoftware tokens, and generating new keys. It is common that these activities involve help\ndesk teams and administrators and the involved people should ensure identities are properly\nverified.", "title": "User identity is verified before modifying any authentication factor.", "description": "Unauthorized individuals cannot gain system access by impersonating the identity of an\nauthorized user.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.3.4", "levels": ["base"], "notes": "", "title": "Invalid authentication attempts are limited.", "description": "- Locking out the user ID after not more than 10 attempts.\n- Setting the lockout duration to a minimum of 30 minutes or until the user's identity is\nconfirmed.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["cracklib_accounts_password_pam_retry", "accounts_passwords_pam_faillock_deny", "enable_authselect", "accounts_passwords_pam_faillock_unlock_time", "accounts_passwords_pam_tally2", "accounts_passwords_pam_tally2_unlock_time", "var_authselect_profile=sssd", "var_accounts_passwords_pam_faillock_deny=10", "var_accounts_passwords_pam_faillock_unlock_time=1800", "var_password_pam_tally2=10", "var_accounts_passwords_pam_tally2_unlock_time=1800"], "controls": []}, {"id": "8.3.5", "levels": ["base"], "notes": "Also related to requirement 2.2.2, 8.2.2 and 8.2.6.", "title": "If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they are set and reset for each user.", "description": "- Set to a unique value for first-time use and upon reset.\n- Forced to be changed immediately after the first use.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["accounts_password_last_change_is_in_past"], "controls": []}, {"id": "8.3.6", "levels": ["base"], "notes": "This requirement is not intended to apply to:\n- User accounts on point-of-sale terminals that have access to only one card number at a\ntime to facilitate a single transaction (such as IDs used by cashiers on point-of-sale\nterminals).\n- Application or system accounts, which are governed by requirements in section 8.6.", "title": "If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they meet the minimum level of complexity.", "description": "- A minimum length of 12 characters (or IF the system does not support 12 characters, a\nminimum length of eight characters).\n- Contain both numeric and alphabetic characters.\nA guessed password/passphrase cannot be verified by either an online or offline brute\nforce attack.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["var_password_pam_ocredit=1", "var_password_pam_ucredit=1", "accounts_password_pam_ucredit", "cracklib_accounts_password_pam_ocredit", "cracklib_accounts_password_pam_ucredit"], "rules": ["accounts_password_pam_dcredit", "cracklib_accounts_password_pam_dcredit", "cracklib_accounts_password_pam_lcredit", "accounts_password_pam_minlen", "accounts_password_pam_lcredit", "cracklib_accounts_password_pam_minlen", "var_password_pam_dcredit=1", "var_password_pam_lcredit=1", "var_password_pam_minlen=12"], "controls": []}, {"id": "8.3.7", "levels": ["base"], "notes": "This requirement is not intended to apply to user accounts on point-of-sale terminals that\nhave access to only one card number at a time to facilitate a single transaction (such as\nIDs used by cashiers on point-of-sale terminals).\nFor RHEL 8 and RHEL 9 systems, the accounts_password_pam_pwhistory_... rules should be\nprefered in detriment of accounts_password_pam_unix_remember. Using both should not create\nconflict but is unnecessary and the last should be filtered out from the profile.", "title": "Individuals are not allowed to submit a new password/passphrase that is the same as any of the last four passwords/passphrases used.", "description": "A previously used password cannot be used to gain access to an account for at least 12\nmonths.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["var_accounts_minimum_age_login_defs=1", "accounts_minimum_age_login_defs"], "rules": ["accounts_password_pam_unix_remember", "accounts_password_pam_pwhistory_remember_password_auth", "accounts_password_pam_pwhistory_remember_system_auth", "var_password_pam_unix_remember=4", "var_password_pam_remember=4", "var_password_pam_remember_control_flag=requisite_or_required"], "controls": []}, {"id": "8.3.8", "levels": ["base"], "notes": "", "title": "Authentication policies and procedures are documented and communicated to all users.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.3.9", "levels": ["base"], "notes": "The requirement does not explicitily define the number of days before the password\nexpiration to warn the users, but the relevant rules were selected here as they do not\ncause any problems in combination with password lifetime rules.", "title": "If passwords/passphrases are used as the only authentication factor for user access (i.e., in any single-factor authentication implementation) they should have a limited lifetime.", "description": "If passwords/passphrases are used as the only authentication factor for user access (i.e.,\nin any single-factor authentication implementation) then either:\n- Passwords/passphrases are changed at least once every 90 days,\nOR\n- The security posture of accounts is dynamically analyzed, and real-time access to\nresources is automatically determined accordingly.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["accounts_password_warn_age_login_defs", "accounts_maximum_age_login_defs", "accounts_password_set_warn_age_existing", "accounts_password_set_max_life_existing", "var_accounts_maximum_age_login_defs=90", "var_accounts_password_warn_age_login_defs=7"], "controls": []}, {"id": "8.3.10.1", "levels": ["base"], "notes": "This requirement is already covered by 8.3.9.", "title": "Additional requirement for service providers only: If passwords/passphrases are used as the only authentication factor for customer user access (i.e., in any single-factor authentication implementation) they should have a limited lifetime.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["accounts_maximum_age_login_defs", "var_accounts_maximum_age_login_defs=90"], "rules": [], "controls": []}, {"id": "8.3.10", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: If passwords/passphrases are used as the only authentication factor for customer user access to cardholder data (i.e., in any single-factor authentication implementation) then guidance is provided to customer users.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["8.3.10.1"]}, {"id": "8.3.11", "levels": ["base"], "notes": "", "title": "Where authentication factors such as physical or logical security tokens, smart cards, or certificates are used, factors are not shared among multiple users and the usage is controlled.'", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.3", "levels": ["base"], "notes": "", "title": "Strong authentication for users and administrators is established and managed.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["cracklib_accounts_password_pam_dcredit", "accounts_password_pam_dcredit", "accounts_password_pam_pwhistory_remember_password_auth", "ensure_shadow_group_empty", "accounts_passwords_pam_tally2", "accounts_password_pam_lcredit", "accounts_password_all_shadowed", "no_empty_passwords", "accounts_password_set_max_life_existing", "set_password_hashing_algorithm_logindefs", "cracklib_accounts_password_pam_retry", "enable_authselect", "accounts_passwords_pam_faillock_unlock_time", "accounts_password_pam_pwhistory_remember_system_auth", "accounts_password_pam_minlen", "accounts_maximum_age_login_defs", "accounts_passwords_pam_tally2_unlock_time", "accounts_password_warn_age_login_defs", "accounts_passwords_pam_faillock_deny", "disable_host_auth", "gnome_gdm_disable_automatic_login", "cracklib_accounts_password_pam_lcredit", "set_password_hashing_algorithm_commonauth", "set_password_hashing_algorithm_systemauth", "cracklib_accounts_password_pam_minlen", "set_password_hashing_algorithm_libuserconf", "accounts_password_last_change_is_in_past", "gnome_gdm_disable_unattended_automatic_login", "accounts_password_pam_unix_remember", "accounts_password_set_warn_age_existing", "gnome_gdm_disable_guest_login", "var_accounts_maximum_age_login_defs=90", "var_accounts_password_warn_age_login_defs=7", "var_password_pam_unix_remember=4", "var_password_pam_remember=4", "var_password_pam_remember_control_flag=requisite_or_required", "var_password_pam_dcredit=1", "var_password_pam_lcredit=1", "var_password_pam_minlen=12", "var_authselect_profile=sssd", "var_accounts_passwords_pam_faillock_deny=10", "var_accounts_passwords_pam_faillock_unlock_time=1800", "var_password_pam_tally2=10", "var_accounts_passwords_pam_tally2_unlock_time=1800", "var_password_hashing_algorithm=SHA512", "var_password_hashing_algorithm_pam=sha512"], "controls": ["8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.3.6", "8.3.7", "8.3.8", "8.3.9", "8.3.10.1", "8.3.10", "8.3.11"]}, {"id": "8.4.1", "levels": ["base"], "notes": "", "title": "MFA is implemented for all non-console access into the CDE for personnel with administrative access.", "description": null, "rationale": null, "automated": "no", "status": "supported", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["var_smartcard_drivers=cac", "configure_opensc_card_drivers", "force_opensc_card_drivers", "install_smartcard_packages", "service_pcscd_enabled", "sssd_enable_smartcards"], "rules": [], "controls": []}, {"id": "8.4.2", "levels": ["base"], "notes": "", "title": "MFA is implemented for all non-console access into the CDE.", "description": "Access into the CDE cannot be obtained by the use of a single authentication factor.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.4.3", "levels": ["base"], "notes": "", "title": "MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.4", "levels": ["base"], "notes": "This parent requirement does not set one specific combination of Multi-factor authentication\n(MFA), so we can't enforce the use of smartcards or any specific solution. The systems\nusually support MFA but the chosen solution depends on site policies.", "title": "Multi-factor authentication (MFA) is implemented to secure access into the CDE.", "description": null, "rationale": null, "automated": "no", "status": "supported", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["8.4.1", "8.4.2", "8.4.3"]}, {"id": "8.5.1", "levels": ["base"], "notes": "Each site might have a different MFA solution and each solution has its own capabilities.\nThis requirement demands manual assessment based on site policies.", "title": "MFA systems are properly implemented.", "description": "- The MFA system is not susceptible to replay attacks.\n- MFA systems cannot be bypassed by any users, including administrative users unless\nspecifically documented, and authorized by management on an exception basis, for a limited\ntime period.\n- At least two different types of authentication factors are used.\n- Success of all authentication factors is required before access is granted.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.5", "levels": ["base"], "notes": "", "title": "Multi-factor authentication (MFA) systems are configured to prevent misuse.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["8.5.1"]}, {"id": "8.6.1", "levels": ["base"], "notes": "This requirement is related to 2.2.2, 2.2.6, 8.2.1 and 8.2.2. Specifically on 8.2.2 system\naccounts usage is restricted. Exceptions to system accounts should be manually checked to\nensure the requirements in description. This requirement although implements some extra\ncontrols regarding root account.", "title": "If accounts used by systems or applications can be used for interactive login, they are managed.", "description": "- Interactive use is prevented unless needed for an exceptional circumstance.\n- Interactive use is limited to the time needed for the exceptional circumstance.\n- Business justification for interactive use is documented.\n- Interactive use is explicitly approved by management.\n- Individual user identity is confirmed before access to account is granted.\n- Every action taken is attributable to an individual user.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["securetty_root_login_console_only", "accounts_tmout", "no_direct_root_logins"], "controls": []}, {"id": "8.6.2", "levels": ["base"], "notes": "", "title": "Passwords/passphrases for any application and system accounts that can be used for interactive login are not hard coded in scripts, configuration/property files, or bespoke and custom source code.", "description": "Passwords/passphrases used by application and system accounts cannot be used by\nunauthorized personnel.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.6.3", "levels": ["base"], "notes": "Related to requirements 8.3.6 and 8.3.9.", "title": "Passwords/passphrases for any application and system accounts are protected against misuse.", "description": "- Passwords/passphrases are changed periodically (at the frequency defined in the entity's\ntargeted risk analysis, which is performed according to all elements specified in\nRequirement 12.3.1) and upon suspicion or confirmation of compromise.\n- Passwords/passphrases are constructed with sufficient complexity appropriate for how\nfrequently the entity changes the passwords/passphrases.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "8.6", "levels": ["base"], "notes": "", "title": "Use of application and system accounts and associated authentication factors is strictly managed.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["securetty_root_login_console_only", "accounts_tmout", "no_direct_root_logins"], "controls": ["8.6.1", "8.6.2", "8.6.3"]}, {"id": "9.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 9 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 9 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 9 are documented, assigned and understood\nby the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 9 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for restricting physical access to cardholder data are defined and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.1.1", "9.1.2"]}, {"id": "9.2.1.1", "levels": ["base"], "notes": "", "title": "Individual physical access to sensitive areas within the CDE is monitored with either video cameras or physical access control mechanisms (or both).", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.2.1", "levels": ["base"], "notes": "", "title": "Appropriate facility entry controls are in place to restrict physical access to systems in the CDE.", "description": "System components in the CDE cannot be physically accessed by unauthorized personnel.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.2.1.1"]}, {"id": "9.2.2", "levels": ["base"], "notes": "", "title": "Physical and/or logical controls are implemented to restrict use of publicly accessible network jacks within the facility.", "description": "Unauthorized devices cannot connect to the entity's network from public areas within the\nfacility.", "rationale": null, "automated": "no", "status": "not applicable", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.2.3", "levels": ["base"], "notes": "", "title": "Physical access to wireless access points, gateways, networking/communications hardware, and telecommunication lines within the facility is restricted", "description": "Physical networking equipment cannot be accessed by unauthorized personnel.", "rationale": null, "automated": "no", "status": "not applicable", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.2.4", "levels": ["base"], "notes": "Related to requirement 8.2.8.\nThis requirement asks to observe a system administrator's attempt to log into consoles in\nsensitive areas and verify that they are \"locked\" to prevent unauthorized use. Therefore\nit is a manual requirement applicable only very specific circumstances.", "title": "Access to consoles in sensitive areas is restricted via locking when not in use.", "description": "Physical consoles within sensitive areas cannot be used by unauthorized personnel.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.2", "levels": ["base"], "notes": "", "title": "Physical access controls manage entry into facilities and systems containing cardholder data.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.2.1.1", "9.2.1", "9.2.2", "9.2.3", "9.2.4"]}, {"id": "9.3.1.1", "levels": ["base"], "notes": "", "title": "Physical access to sensitive areas within the CDE for personnel is controlled", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.3.1", "levels": ["base"], "notes": "", "title": "Procedures are implemented for authorizing and managing physical access of personnel to the CDE.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.3.1.1"]}, {"id": "9.3.2", "levels": ["base"], "notes": "", "title": "Procedures are implemented for authorizing and managing visitor access to the CDE.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.3.3", "levels": ["base"], "notes": "", "title": "Visitor badges or identification are surrendered or deactivated before visitors leave the facility or at the date of expiration.", "description": "Visitor identification or badges cannot be reused after expiration.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.3.4", "levels": ["base"], "notes": "", "title": "Visitor logs are used to maintain a physical record of visitor activity both within the facility and within sensitive areas.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.3", "levels": ["base"], "notes": "", "title": "Physical access for personnel and visitors is authorized and managed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.3.1.1", "9.3.1", "9.3.2", "9.3.3", "9.3.4"]}, {"id": "9.4.1.1", "levels": ["base"], "notes": "", "title": "Offline media backups with cardholder data are stored in a secure location.", "description": "Offline backups cannot be accessed by unauthorized personnel.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.4.1.2", "levels": ["base"], "notes": "", "title": "The security of the offline media backup location(s) with cardholder data is reviewed at least once every 12 months.", "description": "The security controls protecting offline backups are verified periodically by\ninspection.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.4.1", "levels": ["base"], "notes": "", "title": "All media with cardholder data is physically secured.", "description": "Media with cardholder data cannot be accessed by unauthorized personnel.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.4.1.1", "9.4.1.2"]}, {"id": "9.4.2", "levels": ["base"], "notes": "", "title": "All media with cardholder data is classified in accordance with the sensitivity of the data.", "description": "Media are classified and protected appropriately.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.4.3", "levels": ["base"], "notes": "", "title": "Media with cardholder data sent outside the facility is secured.", "description": "Media is secured and tracked when transported outside the facility.\n- Media sent outside the facility is logged.\n- Media is sent by secured courier or other delivery method that can be accurately\ntracked.\n- Offsite tracking logs include details about media location.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.4.4", "levels": ["base"], "notes": "", "title": "Management approves all media with cardholder data that is moved outside the facility (including when media is distributed to individuals).", "description": "Media cannot leave a facility without the approval of accountable personnel. Individuals\napproving media movements should have the appropriate level of management authority to\ngrant this approval. However, it is not specifically required that such individuals have\n\"manager\" as part of their title.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.4.5.1", "levels": ["base"], "notes": "", "title": "Inventories of electronic media with cardholder data are conducted at least once every 12 months.", "description": "Media inventories are verified periodically.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.4.5", "levels": ["base"], "notes": "", "title": "Inventory logs of all electronic media with cardholder data are maintained.", "description": "Accurate inventories of stored electronic media are maintained.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.4.5.1"]}, {"id": "9.4.6", "levels": ["base"], "notes": "", "title": "Hard-copy materials with cardholder data are destroyed when no longer needed for business or legal reasons.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.4.7", "levels": ["base"], "notes": "", "title": "Electronic media with cardholder data is destroyed when no longer needed for business or legal reasons.", "description": "- The electronic media is destroyed.\n- The cardholder data is rendered unrecoverable so that it cannot be reconstructed.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.4", "levels": ["base"], "notes": "", "title": "Media with cardholder data is securely stored, accessed, distributed, and destroyed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.4.1.1", "9.4.1.2", "9.4.1", "9.4.2", "9.4.3", "9.4.4", "9.4.5.1", "9.4.5", "9.4.6", "9.4.7"]}, {"id": "9.5.1.1", "levels": ["base"], "notes": "", "title": "An up-to-date list of POI devices is maintained.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.5.1.2.1", "levels": ["base"], "notes": "", "title": "The frequency of periodic POI device inspections and the type of inspections performed is defined in the entity's targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1.", "description": "POI devices are inspected at a frequency that addresses the entity's risk.\nThis requirement is a best practice until 31 March 2025, after which it will be\nrequired and must be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.5.1.2", "levels": ["base"], "notes": "", "title": "POI device surfaces are periodically inspected to detect tampering and unauthorized substitution.", "description": "Point of Interaction Devices cannot be tampered with, substituted without authorization,\nor have skimming attachments installed without timely detection.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.5.1.2.1"]}, {"id": "9.5.1.3", "levels": ["base"], "notes": "", "title": "Training is provided for personnel in POI environments to be aware of attempted tampering or replacement of POI devices.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "9.5.1", "levels": ["base"], "notes": "", "title": "POI devices that capture payment card data via direct physical interaction with the payment card form factor are protected from tampering and unauthorized substitution.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.5.1.1", "9.5.1.2.1", "9.5.1.2", "9.5.1.3"]}, {"id": "9.5", "levels": ["base"], "notes": "", "title": "Point-of-interaction (POI) devices are protected from tampering and unauthorized substitution.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["9.5.1.1", "9.5.1.2.1", "9.5.1.2", "9.5.1.3", "9.5.1"]}, {"id": "10.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 10 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 10 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "10.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 10 are documented, assigned and\nunderstood by the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 10 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "10.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documented.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["10.1.1", "10.1.2"]}, {"id": "10.2.1.1", "levels": ["base"], "notes": "Differently than 10.2.1.4, this requirement is about logginh successful access to\ncardholder data. This kind of events can easily hit performance issues and are usually\nnot necessary if a good access policy is in place. More clarification is needed about\nthis requirement.", "title": "Audit logs capture all individual user access to cardholder data.", "description": "Records of all individual user access to cardholder data are captured.", "rationale": null, "automated": "no", "status": "planned", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["audit_rules_successful_file_modification_open"], "rules": [], "controls": []}, {"id": "10.2.1.2", "levels": ["base"], "notes": "Not all privileged commands have suid or sgid enabled. We probably want to include more\nrules for this requirement.", "title": "Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts.", "description": "Records of all actions performed by individuals with elevated privileges are captured.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["audit_rules_privileged_commands", "audit_rules_privileged_commands_usermod"], "rules": ["audit_rules_suid_privilege_function"], "controls": []}, {"id": "10.2.1.3", "levels": ["base"], "notes": "", "title": "Audit logs capture all access to audit logs.", "description": "Records of all access to audit logs are captured.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["audit_rules_login_events"], "rules": ["audit_sudo_log_events", "audit_rules_login_events_tallylog", "audit_rules_session_events_utmp", "audit_rules_login_events_faillock", "audit_rules_login_events_lastlog", "audit_rules_session_events_btmp", "audit_rules_session_events_wtmp"], "controls": []}, {"id": "10.2.1.4", "levels": ["base"], "notes": "", "title": "Audit logs capture all invalid logical access attempts.", "description": "Records of all invalid access attempts are captured.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["audit_rules_unsuccessful_file_modification_creat", "audit_rules_unsuccessful_file_modification_ftruncate", "audit_rules_unsuccessful_file_modification_open", "audit_rules_unsuccessful_file_modification_open_by_handle_at", "audit_rules_unsuccessful_file_modification_openat", "audit_rules_unsuccessful_file_modification_rename", "audit_rules_unsuccessful_file_modification_renameat", "audit_rules_unsuccessful_file_modification_truncate", "audit_rules_unsuccessful_file_modification_unlink", "audit_rules_unsuccessful_file_modification_unlinkat", "audit_rules_unsuccessful_file_modification"], "rules": ["display_login_attempts"], "controls": []}, {"id": "10.2.1.5", "levels": ["base"], "notes": "", "title": "Audit logs capture all changes to identification and authentication credentials.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["audit_rules_usergroup_modification"], "rules": ["audit_rules_usergroup_modification_opasswd", "audit_rules_sysadmin_actions", "audit_rules_usergroup_modification_group", "audit_rules_usergroup_modification_shadow", "audit_rules_usergroup_modification_passwd", "audit_rules_usergroup_modification_gshadow"], "controls": []}, {"id": "10.2.1.6", "levels": ["base"], "notes": "Ideally should exist rules specifically logging when audit configuration files are\nmodified and audit service state is changed.", "title": "Audit logs capture the initialization of new audit logs, and starting, stopping, or pausing of the existing audit logs.", "description": null, "rationale": null, "automated": "no", "status": "planned", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "10.2.1.7", "levels": ["base"], "notes": "There are enough rules to capture deletion events but not for creation events.\nThis requirement needs to be better investigated to confirm which additional rules would\nsatistfy the requirement.", "title": "Audit logs capture all creation and deletion of system-level objects.", "description": "Records of alterations that indicate a system has been modified from its intended\nfunctionality are captured.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["audit_rules_file_deletion_events"], "rules": ["audit_rules_file_deletion_events_rename", "audit_rules_file_deletion_events_unlinkat", "audit_rules_file_deletion_events_unlink", "audit_rules_file_deletion_events_rmdir", "audit_rules_file_deletion_events_renameat2", "audit_rules_media_export", "audit_rules_file_deletion_events_renameat"], "controls": []}, {"id": "10.2.1", "levels": ["base"], "notes": "", "title": "Audit logs are enabled and active for all system components and cardholder data.", "description": "Records of all activities affecting system components and cardholder data are captured.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["rsyslog_cron_logging", "rsyslog_logging_configured", "service_systemd-journald_enabled", "service_rsyslog_enabled"], "rules": ["audit_rules_suid_privilege_function", "audit_rules_usergroup_modification_opasswd", "audit_rules_file_deletion_events_unlink", "audit_rules_file_deletion_events_rmdir", "audit_rules_sysadmin_actions", "audit_rules_media_export", "audit_sudo_log_events", "display_login_attempts", "package_audit_installed", "audit_rules_session_events_utmp", "audit_rules_login_events_lastlog", "audit_rules_usergroup_modification_gshadow", "audit_rules_file_deletion_events_renameat", "audit_rules_file_deletion_events_rename", "audit_rules_login_events_faillock", "audit_rules_session_events_btmp", "audit_rules_session_events_wtmp", "audit_rules_usergroup_modification_shadow", "audit_rules_login_events_tallylog", "service_auditd_enabled", "audit_rules_file_deletion_events_unlinkat", "audit_rules_usergroup_modification_group", "audit_rules_file_deletion_events_renameat2", "audit_rules_usergroup_modification_passwd"], "controls": ["10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7"]}, {"id": "10.2.2", "levels": ["base"], "notes": "Standard settings for audit should be enough.", "title": "Audit logs record sufficient details for each auditable event.", "description": "- User identification.\n- Type of event.\n- Date and time.\n- Success and failure indication.\n- Origination of event.\n- Identity or name of affected data, system component, resource, or service (for example,\n  name and protocol).", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["auditd_name_format", "var_auditd_name_format=fqd"], "controls": []}, {"id": "10.2", "levels": ["base"], "notes": "", "title": "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["audit_rules_suid_privilege_function", "auditd_name_format", "audit_rules_usergroup_modification_opasswd", "audit_rules_file_deletion_events_rmdir", "audit_rules_file_deletion_events_unlink", "audit_rules_sysadmin_actions", "audit_rules_media_export", "audit_sudo_log_events", "display_login_attempts", "package_audit_installed", "audit_rules_session_events_utmp", "audit_rules_login_events_lastlog", "audit_rules_usergroup_modification_gshadow", "audit_rules_file_deletion_events_renameat", "audit_rules_file_deletion_events_rename", "audit_rules_login_events_faillock", "audit_rules_session_events_btmp", "audit_rules_session_events_wtmp", "audit_rules_usergroup_modification_shadow", "audit_rules_login_events_tallylog", "service_auditd_enabled", "audit_rules_file_deletion_events_unlinkat", "audit_rules_usergroup_modification_group", "audit_rules_file_deletion_events_renameat2", "audit_rules_usergroup_modification_passwd", "var_auditd_name_format=fqd"], "controls": ["10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.1", "10.2.2"]}, {"id": "10.3.1", "levels": ["base"], "notes": "", "title": "Read access to audit logs files is limited to those with a job-related need.", "description": "Stored activity records cannot be accessed by unauthorized personnel.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["directory_access_var_log_audit", "file_permissions_var_log_audit", "permissions_local_var_log", "rsyslog_files_permissions"], "controls": []}, {"id": "10.3.2", "levels": ["base"], "notes": "", "title": "Audit log files are protected to prevent modifications by individuals.", "description": "Stored activity records cannot be modified by personnel.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["file_group_ownership_var_log_audit", "file_ownership_var_log_audit", "rsyslog_files_groupownership", "audit_rules_immutable", "rsyslog_files_ownership"], "controls": []}, {"id": "10.3.3", "levels": ["base"], "notes": "Although the technologies in general allow to send logs to a centralized server, some\nparameters for this configuration are specific to each site policy and therefore the\nrequirement demands manual assessment.", "title": "Audit log files, including those for external-facing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify.", "description": "Stored activity records are secured and preserved in a central location to prevent\nunauthorized modification.", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["rsyslog_remote_loghost", "rsyslog_nolisten"], "rules": ["auditd_audispd_syslog_plugin_activated", "package_audispd-plugins_installed", "package_audit-audispd-plugins_installed"], "controls": []}, {"id": "10.3.4", "levels": ["base"], "notes": "", "title": "File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts.", "description": "Stored activity records cannot be modified without an alert being generated.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["audit_rules_dac_modification_setxattr", "audit_rules_dac_modification_fchown", "audit_rules_dac_modification_fchownat", "audit_rules_mac_modification", "audit_rules_dac_modification_chown", "audit_rules_dac_modification_lremovexattr", "audit_rules_mac_modification_etc_selinux", "audit_rules_dac_modification_lchown", "audit_rules_dac_modification_removexattr", "audit_rules_dac_modification_lsetxattr", "audit_rules_dac_modification_fremovexattr", "audit_rules_networkconfig_modification", "audit_rules_dac_modification_chmod", "audit_rules_dac_modification_fchmodat", "audit_rules_dac_modification_fchmodat2", "audit_rules_dac_modification_fchmod", "audit_rules_dac_modification_fsetxattr"], "controls": []}, {"id": "10.3", "levels": ["base"], "notes": "", "title": "Audit logs are protected from destruction and unauthorized modifications.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["audit_rules_dac_modification_fchown", "audit_rules_mac_modification", "audit_rules_dac_modification_chown", "file_ownership_var_log_audit", "audit_rules_dac_modification_removexattr", "audit_rules_networkconfig_modification", "package_audispd-plugins_installed", "package_audit-audispd-plugins_installed", "audit_rules_dac_modification_chmod", "audit_rules_dac_modification_fchmodat", "audit_rules_dac_modification_fchmod", "audit_rules_dac_modification_fchownat", "auditd_audispd_syslog_plugin_activated", "directory_access_var_log_audit", "audit_rules_dac_modification_setxattr", "file_permissions_var_log_audit", "audit_rules_dac_modification_lremovexattr", "audit_rules_mac_modification_etc_selinux", "file_group_ownership_var_log_audit", "permissions_local_var_log", "audit_rules_dac_modification_lsetxattr", "rsyslog_files_permissions", "audit_rules_immutable", "audit_rules_dac_modification_lchown", "rsyslog_files_groupownership", "audit_rules_dac_modification_fremovexattr", "rsyslog_files_ownership", "audit_rules_dac_modification_fchmodat2", "audit_rules_dac_modification_fsetxattr"], "controls": ["10.3.1", "10.3.2", "10.3.3", "10.3.4"]}, {"id": "10.4.1.1", "levels": ["base"], "notes": "Automation mechanisms, solutions and approaches vary for each organizarion.", "title": "Automated mechanisms are used to perform audit log reviews.", "description": "Potentially suspicious or anomalous activities are identified via a repeatable and\nconsistent mechanism. This requirement is a best practice until 31 March 2025, after\nwhich it will be required and must be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "10.4.1", "levels": ["base"], "notes": "", "title": "The audit logs are reviewed at least once daily.", "description": "- All security events.\n- Logs of all system components that store, process, or transmit CHD and/or SAD.\n- Logs of all critical system components.\n- Logs of all servers and system components that perform security functions (for example,\n  network security controls, intrusion-detection systems/intrusion-prevention systems\n  (IDS/IPS), authentication servers).", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["10.4.1.1"]}, {"id": "10.4.2.1", "levels": ["base"], "notes": "", "title": "The frequency of periodic log reviews for all other system components (not defined in Requirement 10.4.1) is defined in the entity's targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1", "description": "Log reviews for lower-risk system components are performed at a frequency that addresses\nthe entity's risk. This requirement is a best practice until 31 March 2025, after which\nit will be required and must be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "10.4.2", "levels": ["base"], "notes": "", "title": "Logs of all other system components (those not specified in Requirement 10.4.1) are reviewed periodically.", "description": "Potentially suspicious or anomalous activities for other system components (not included\nin 10.4.1) are reviewed in accordance with the entity's identified risk. This requirement\nis applicable to all other in-scope system components not included in Requirement 10.4.1.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["10.4.2.1"]}, {"id": "10.4.3", "levels": ["base"], "notes": "", "title": "Exceptions and anomalies identified during the review process are addressed.", "description": "Suspicious or anomalous activities are addressed.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "10.4", "levels": ["base"], "notes": "", "title": "Audit logs are reviewed to identify anomalies or suspicious activity.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["10.4.1.1", "10.4.1", "10.4.2.1", "10.4.2", "10.4.3"]}, {"id": "10.5.1", "levels": ["base"], "notes": "It is not simple to ensure 12 months history is present in each system but the rules in\nthis requirement ensures the logs are not lost without administrators awareness.", "title": "Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis.", "description": "Historical records of activity are available immediately to support incident response and\nare retained for at least 12 months.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["var_auditd_action_mail_acct=root", "auditd_data_retention_action_mail_acct", "auditd_data_retention_num_logs", "auditd_data_retention_max_log_file", "auditd_data_retention_max_log_file_action", "auditd_data_retention_max_log_file_action_stig", "ensure_logrotate_activated"], "rules": ["timer_logrotate_enabled", "auditd_data_retention_space_left_action", "package_logrotate_installed", "auditd_data_retention_space_left", "auditd_data_retention_admin_space_left_action", "var_auditd_admin_space_left_action=single", "var_auditd_space_left=100MB", "var_auditd_space_left_action=email"], "controls": []}, {"id": "10.5", "levels": ["base"], "notes": "", "title": "Audit log history is retained and available for analysis.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["timer_logrotate_enabled", "auditd_data_retention_space_left_action", "package_logrotate_installed", "auditd_data_retention_space_left", "auditd_data_retention_admin_space_left_action", "var_auditd_admin_space_left_action=single", "var_auditd_space_left=100MB", "var_auditd_space_left_action=email"], "controls": ["10.5.1"]}, {"id": "10.6.1", "levels": ["base"], "notes": "Maybe it is possible to optmize some similar rules related to ntp.", "title": "System clocks and time are synchronized using time-synchronization technology.", "description": "Common time is established across all systems. Keeping time-synchronization technology\ncurrent includes managing vulnerabilities and patching the technology according to PCI DSS\nRequirements 6.3.1 and 6.3.3.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["service_timesyncd_enabled", "service_chronyd_or_ntpd_enabled", "service_ntpd_enabled", "service_ntp_enabled", "package_chrony_installed"], "controls": []}, {"id": "10.6.2", "levels": ["base"], "notes": "The selected rules might need updates in order to restrict their platform applicability\nto avoid conflicts.", "title": "Systems are configured to the correct and consistent time.", "description": "- One or more designated time servers are in use.\n- Only the designated central time server(s) receives time from external sources.\n- Time received from external sources is based on International Atomic Time or Coordinated\n  Universal Time (UTC).\n- The designated time server(s) accept time updates only from specific industry-accepted\n  external sources.\n- Where there is more than one designated time server, the time servers peer with one\n  another to keep accurate time.\n- Internal systems receive time information only from designated central time server(s).", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["chronyd_configure_pool_and_server", "chronyd_or_ntpd_specify_multiple_servers"], "rules": ["ntpd_specify_remote_server", "chronyd_specify_remote_server", "ntpd_specify_multiple_servers", "var_multiple_time_servers=generic"], "controls": []}, {"id": "10.6.3", "levels": ["base"], "notes": "", "title": "Time synchronization settings and data are protected.", "description": "- Access to time data is restricted to only personnel with a business need.\n- Any changes to time settings on critical systems are logged, monitored, and reviewed.", "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["chronyd_client_only"], "rules": ["audit_rules_time_watch_localtime", "audit_rules_time_adjtimex", "audit_rules_time_clock_settime", "chronyd_run_as_chrony_user", "audit_rules_time_settimeofday", "audit_rules_time_stime"], "controls": []}, {"id": "10.6", "levels": ["base"], "notes": "", "title": "Time-synchronization mechanisms support consistent time settings across all systems.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["audit_rules_time_watch_localtime", "chronyd_specify_remote_server", "service_timesyncd_enabled", "service_chronyd_or_ntpd_enabled", "ntpd_specify_multiple_servers", "service_ntpd_enabled", "audit_rules_time_adjtimex", "audit_rules_time_clock_settime", "service_ntp_enabled", "ntpd_specify_remote_server", "chronyd_run_as_chrony_user", "audit_rules_time_settimeofday", "package_chrony_installed", "audit_rules_time_stime", "var_multiple_time_servers=generic"], "controls": ["10.6.1", "10.6.2", "10.6.3"]}, {"id": "10.7.1", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: Failures of critical security control systems are detected, alerted, and addressed promptly.", "description": "It includes but is not limited to failure of the following critical security control\nsystems:\n- Network security controls.\n- IDS/IPS.\n- FIM.\n- Anti-malware solutions.\n- Physical access controls.\n- Logical access controls.\n- Audit logging mechanisms.\n- Segmentation controls (if used).", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "10.7.2", "levels": ["base"], "notes": "", "title": "Failures of critical security control systems are detected, alerted, and addressed promptly.", "description": "It includes but is not limited to failure of the following critical security control\nsystems:\n- Network security controls.\n- IDS/IPS.\n- Change-detection mechanisms.\n- Anti-malware solutions.\n- Physical access controls.\n- Logical access controls.\n- Audit logging mechanisms.\n- Segmentation controls (if used).\n- Audit log review mechanisms.\n- Automated security testing tools (if used).", "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["grub2_audit_argument", "grub2_audit_backlog_limit_argument", "var_audit_backlog_limit=8192"], "controls": []}, {"id": "10.7.3", "levels": ["base"], "notes": "", "title": "Failures of any critical security controls systems are responded to restore security functions, ensure documentation, address security issues and prevent other failures.", "description": "It includes but is not limited to:\n- Restoring security functions.\n- Identifying and documenting the duration (date and time from start to end) of the\n  security failure.\n- Identifying and documenting the cause(s) of failure and documenting required\n  remediation.\n- Identifying and addressing any security issues that arose during the failure.\n- Determining whether further actions are required as a result of the security failure.\n- Implementing controls to prevent the cause of failure from reoccurring.\n- Resuming monitoring of security controls.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "10.7", "levels": ["base"], "notes": "", "title": "Failures of critical security control systems are detected, reported, and responded to promptly.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": ["grub2_audit_argument", "grub2_audit_backlog_limit_argument", "var_audit_backlog_limit=8192"], "controls": ["10.7.1", "10.7.2", "10.7.3"]}, {"id": "11.1.1", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that security policies and\noperational procedures identified in Requirement 11 are managed in accordance with all\nelements specified in this requirement.", "title": "All security policies and operational procedures that are identified in Requirement 11 are Documented, Kept up to date, In use and Known to all affected parties.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.1.2", "levels": ["base"], "notes": "Examine documentation and interview personnel to verify that day-to-day responsibilities\nfor performing all the activities in Requirement 11 are documented, assigned and\nunderstood by the assigned personnel.", "title": "Roles and responsibilities for performing activities in Requirement 11 are documented, assigned, and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.1", "levels": ["base"], "notes": "", "title": "Processes and mechanisms for regularly testing security of systems and networks are defined and understood.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["11.1.1", "11.1.2"]}, {"id": "11.2.1", "levels": ["base"], "notes": "", "title": "Authorized and unauthorized wireless access points are managed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.2.2", "levels": ["base"], "notes": "", "title": "An inventory of authorized wireless access points is maintained, including a documented business justification.", "description": "Unauthorized wireless access points are not mistaken for authorized wireless access\npoints.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.2", "levels": ["base"], "notes": "", "title": "Wireless access points are identified and monitored, and unauthorized wireless access points are addressed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["11.2.1", "11.2.2"]}, {"id": "11.3.1.1", "levels": ["base"], "notes": "", "title": "All other applicable vulnerabilities (those not ranked as high-risk vulnerabilities or critical vulnerabilities according to the entity's vulnerability risk rankings defined at Requirement 6.3.1) are managed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.3.1.2", "levels": ["base"], "notes": "", "title": "Internal vulnerability scans are performed via authenticated scanning.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.3.1.3", "levels": ["base"], "notes": "", "title": "Internal vulnerability scans are performed after any significant change.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.3.1", "levels": ["base"], "notes": "", "title": "Internal vulnerability scans are performed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["11.3.1.1", "11.3.1.2", "11.3.1.3"]}, {"id": "11.3.2.1", "levels": ["base"], "notes": "", "title": "External vulnerability scans are performed after any significant change.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.3.2", "levels": ["base"], "notes": "", "title": "External vulnerability scans are performed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["11.3.2.1"]}, {"id": "11.3", "levels": ["base"], "notes": "", "title": "External and internal vulnerabilities are regularly identified, prioritized, and addressed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["11.3.1.1", "11.3.1.2", "11.3.1.3", "11.3.1", "11.3.2.1", "11.3.2"]}, {"id": "11.4.1", "levels": ["base"], "notes": "", "title": "A penetration testing methodology is defined, documented, and implemented by the entity.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.4.2", "levels": ["base"], "notes": "", "title": "Internal penetration testing is performed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.4.3", "levels": ["base"], "notes": "", "title": "External penetration testing is performed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.4.4", "levels": ["base"], "notes": "", "title": "Exploitable vulnerabilities and security weaknesses found during penetration testing are corrected", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.4.5", "levels": ["base"], "notes": "", "title": "If segmentation is used to isolate the CDE from other networks, penetration tests are performed on segmentation controls.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.4.6", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: If segmentation is used to isolate the CDE from other networks, penetration tests are performed on segmentation controls.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.4.7", "levels": ["base"], "notes": "", "title": "Additional requirement for multi-tenant service providers only: Multi-tenant service providers support their customers for external penetration testing per Requirement 11.4.3 and 11.4.4.", "description": "Multi-tenant service providers support their customers' need for technical testing either\nby providing access or evidence that comparable technical testing has been undertaken.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.4", "levels": ["base"], "notes": "", "title": "External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["11.4.1", "11.4.2", "11.4.3", "11.4.4", "11.4.5", "11.4.6", "11.4.7"]}, {"id": "11.5.1.1", "levels": ["base"], "notes": "The policy is not explicit about any specific solution. The solution might vary\ndepending on site policies.", "title": "Additional requirement for service providers only: Intrusion-detection and/or intrusion-prevention techniques detect, alert on/prevent, and address covert malware communication channels.", "description": "Mechanisms are in place to detect and alert/prevent covert communications with\ncommand-and-control systems. Alerts generated by these mechanisms are responded to by\npersonnel, or by automated means that ensure that such communications are blocked. This\nrequirement applies only when the entity being assessed is a service provider. This\nrequirement is a best practice until 31 March 2025, after which it will be required and\nmust be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["install_hids", "package_MFEhiplsm_installed"], "rules": [], "controls": []}, {"id": "11.5.1", "levels": ["base"], "notes": "", "title": "Intrusion-detection and/or intrusion-prevention techniques are used to detect and/or prevent intrusions into the network.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["11.5.1.1"]}, {"id": "11.5", "levels": ["base"], "notes": "", "title": "Network intrusions and unexpected file changes are detected and responded to.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["11.5.1.1", "11.5.1"]}, {"id": "11.5.2", "levels": ["base"], "notes": "", "title": "A change-detection mechanism (for example, file integrity monitoring tools) is deployed.", "description": null, "rationale": null, "automated": "yes", "status": "automated", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["disable_prelink"], "rules": ["aide_periodic_checking_systemd_timer", "rpm_verify_hashes", "rpm_verify_permissions", "aide_periodic_cron_checking", "package_aide_installed", "rpm_verify_ownership", "aide_build_database"], "controls": []}, {"id": "11.6.1", "levels": ["base"], "notes": "It depends on controls in application level, which varies based on site policies.", "title": "A change- and tamper-detection mechanism is deployed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "11.6", "levels": ["base"], "notes": "", "title": "Unauthorized changes on payment pages are detected and responded to.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["11.6.1"]}, {"id": "12.1.1", "levels": ["base"], "notes": "", "title": "An overall information security policy is established, published, maintained and disseminated to all relevant personnel, as well as to relevant vendors and business partners.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.1.2", "levels": ["base"], "notes": "", "title": "The information security policy is updated and reviewed at least once every 12 months.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.1.3", "levels": ["base"], "notes": "", "title": "The security policy clearly defines information security roles and responsibilities for all personnel, and all personnel are aware of and acknowledge their information security responsibilities.", "description": "Personnel understand their role in protecting the entity's cardholder data.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.1.4", "levels": ["base"], "notes": "", "title": "Responsibility for information security is formally assigned to a Chief Information Security Officer or other information security knowledgeable member of executive management.", "description": "A designated member of executive management is responsible for information security.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.1", "levels": ["base"], "notes": "", "title": "A comprehensive information security policy that governs and provides direction for protection of the entity's information assets is known and current.", "description": null, "rationale": null, "automated": "no", "status": "partial", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.1.1", "12.1.2", "12.1.3", "12.1.4"]}, {"id": "12.2.1", "levels": ["base"], "notes": "", "title": "Acceptable use policies for end-user technologies are documented and implemented.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.2", "levels": ["base"], "notes": "", "title": "Acceptable use policies for end-user technologies are defined and implemented.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.2.1"]}, {"id": "12.3.1", "levels": ["base"], "notes": "", "title": "For each PCI DSS requirement that specifies completion of a targeted risk analysis, the analysis is documented.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.3.2", "levels": ["base"], "notes": "", "title": "A targeted risk analysis is performed for each PCI DSS requirement that the entity meets with the customized approach", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.3.3", "levels": ["base"], "notes": "Related to requirement 2.2.7.", "title": "Cryptographic cipher suites and protocols in use are documented and reviewed at least once every 12 months.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.3.4", "levels": ["base"], "notes": "The technical requirement related to this is 6.3.3.", "title": "Hardware and software technologies in use are reviewed at least once every 12 months.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.3", "levels": ["base"], "notes": "", "title": "Risks to the cardholder data environment are formally identified, evaluated, and managed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.3.1", "12.3.2", "12.3.3", "12.3.4"]}, {"id": "12.4.1", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: Responsibility is established by executive management for the protection of cardholder data and a PCI DSS compliance program.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.4.2.1", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: Reviews conducted in accordance with Requirement 12.4.2 are documented.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.4.2", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: Reviews are performed at least once every three months to confirm that personnel are performing their tasks in accordance with all security policies and operational procedures.", "description": "Reviews are performed by personnel other than those responsible for performing the given\ntask.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.4.2.1"]}, {"id": "12.4", "levels": ["base"], "notes": "", "title": "PCI DSS compliance is managed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.4.1", "12.4.2.1", "12.4.2"]}, {"id": "12.5.1", "levels": ["base"], "notes": "", "title": "An inventory of system components that are in scope for PCI DSS, including a description of function/use, is maintained and kept current.", "description": "All system components in scope for PCI DSS are identified and known.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.5.2.1", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: PCI DSS scope is documented and confirmed by the entity at least once every six months and upon significant change to the in-scope environment. At a minimum, the scoping validation includes all the elements specified in Requirement 12.5.2.", "description": "The accuracy of PCI DSS scope is verified to be continuously accurate by comprehensive\nanalysis and appropriate technical measures. This requirement applies only when the\nentity being assessed is a service provider. This requirement is a best practice until\n31 March 2025, after which it will be required and must be fully considered during a\nPCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.5.2", "levels": ["base"], "notes": "", "title": "PCI DSS scope is documented and confirmed by the entity at least once every 12 months and upon significant change to the in-scope environment.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.5.2.1"]}, {"id": "12.5.3", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: Significant changes to organizational structure result in a documented (internal) review of the impact to PCI DSS scope and applicability of controls, with results communicated to executive management.", "description": "PCI DSS scope is confirmed after significant organizational change. This requirement\napplies only when the entity being assessed is a service provider. This requirement is a\nbest practice until 31 March 2025, after which it will be required and must be fully\nconsidered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.5", "levels": ["base"], "notes": "", "title": "PCI DSS scope is documented and validated.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.5.1", "12.5.2.1", "12.5.2", "12.5.3"]}, {"id": "12.6.1", "levels": ["base"], "notes": "", "title": "A formal security awareness program is implemented to make all personnel aware of the entity's information security policy and procedures, and their role in protecting the cardholder data.", "description": "Personnel are knowledgeable about the threat landscape, their responsibility for the\noperation of relevant security controls, and are able to access assistance and guidance\nwhen required.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.6.2", "levels": ["base"], "notes": "", "title": "The security awareness program is updated and reviewed at least once every 12 months.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.6.3.1", "levels": ["base"], "notes": "", "title": "Security awareness training includes awareness of threats and vulnerabilities that could impact the security of the CDE.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.6.3.2", "levels": ["base"], "notes": "", "title": "Security awareness training includes awareness about the acceptable use of end-user technologies in accordance with Requirement 12.2.1.", "description": "Personnel are knowledgeable about their responsibility for the security and operation of\nend-user technologies and are able to access assistance and guidance when required. This\nrequirement is a best practice until 31 March 2025, after which it will be required and\nmust be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.6.3", "levels": ["base"], "notes": "", "title": "Personnel receive security awareness training upon hire and at least once every 12 months via multiple methods of communication.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.6.3.1", "12.6.3.2"]}, {"id": "12.6", "levels": ["base"], "notes": "", "title": "Security awareness education is an ongoing activity.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.6.1", "12.6.2", "12.6.3.1", "12.6.3.2", "12.6.3"]}, {"id": "12.7.1", "levels": ["base"], "notes": "", "title": "Potential personnel who will have access to the CDE are screened, within the constraints of local laws, prior to hire to minimize the risk of attacks from internal sources.", "description": "The risk related to allowing new members of staff access to the CDE is understood and\nmanaged. For those potential personnel to be hired for positions such as store cashiers,\nwho only have access to one card number at a time when facilitating a transaction, this\nrequirement is a recommendation only.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.7", "levels": ["base"], "notes": "", "title": "Personnel are screened to reduce risks from insider threats.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.7.1"]}, {"id": "12.8.1", "levels": ["base"], "notes": "", "title": "A list of all third-party service providers (TPSPs) with which account data is shared or that could affect the security of account data is maintained, including a description for each of the services provided.", "description": "Records are maintained of TPSPs and the services provided. The use of a PCI DSS compliant\nTPSP does not make an entity PCI DSS compliant, nor does it remove the entit's\nresponsibility for its own PCI DSS compliance.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.8.2", "levels": ["base"], "notes": "", "title": "Written agreements with TPSPs are maintained", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.8.3", "levels": ["base"], "notes": "", "title": "An established process is implemented for engaging TPSPs, including proper due diligence prior to engagement.", "description": "The capability, intent, and resources of a prospective TPSP to adequately protect account\ndata are assessed before the TPSP is engaged.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.8.4", "levels": ["base"], "notes": "", "title": "A program is implemented to monitor TPSPs' PCI DSS compliance status at least once every 12 months.", "description": "The PCI DSS compliance status of TPSPs is verified periodically. Where an entity has an\nagreement with a TPSP for meeting PCI DSS requirements on behalf of the entity (for\nexample, via a firewall service), the entity must work with the TPSP to make sure the\napplicable PCI DSS requirements are met. If the TPSP does not meet those applicable\nPCI DSS requirements, then those requirements are also \"not in place\" for the entity.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.8.5", "levels": ["base"], "notes": "", "title": "Information is maintained about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between the TPSP and the entity.", "description": "Records detailing the PCI DSS requirements and related system components for which each\nTPSP is solely or jointly responsible, are maintained and reviewed periodically.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.8", "levels": ["base"], "notes": "", "title": "Risk to information assets associated with third-party service provider (TPSP) relationships is managed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.8.1", "12.8.2", "12.8.3", "12.8.4", "12.8.5"]}, {"id": "12.9.1", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: TPSPs provide written agreements to\ncustomers that include acknowledgments that TPSPs are responsible for the security of\naccount data the TPSP possesses or otherwise stores, processes, or transmits on behalf of\nthe customer, or to the extent that the TPSP could impact the security of the customer's\ncardholder data and/or sensitive authentication data.", "description": "TPSPs formally acknowledge their security responsibilities to their customers. This\nrequirement applies only when the entity being assessed is a service provider. The exact\nwording of an agreement will depend on the details of the service being provided, and the\nresponsibilities assigned to each party. The agreement does not have to include the exact\nwording provided in this requirement.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.9.2", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: TPSPs support their customers' requests\nfor information to meet Requirements 12.8.4 and 12.8.5.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.9", "levels": ["base"], "notes": "", "title": "Third-party service providers (TPSPs) support their customers' PCI DSS compliance.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.9.1", "12.9.2"]}, {"id": "12.10.1", "levels": ["base"], "notes": "", "title": "An incident response plan exists and is ready to be activated in the event of a suspected or confirmed security incident.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.10.2", "levels": ["base"], "notes": "", "title": "At least once every 12 months, the security incident response plan is reviewed, updated, and tested.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.10.3", "levels": ["base"], "notes": "", "title": "Specific personnel are designated to be available on a 24/7 basis to respond to suspected or confirmed security incidents.", "description": "Incidents are responded to immediately where appropriate.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.10.4.1", "levels": ["base"], "notes": "", "title": "The frequency of periodic training for incident response personnel is defined in the entity's targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1.", "description": "Incident response personnel are trained at a frequency that addresses the entity's risk.\nThis requirement is a best practice until 31 March 2025, after which it will be required\nand must be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.10.4", "levels": ["base"], "notes": "", "title": "Personnel responsible for responding to suspected and confirmed security incidents are appropriately and periodically trained on their incident response responsibilities.", "description": "Personnel are knowledgeable about their role and responsibilities in incident response and\nare able to access assistance and guidance when required.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.10.4.1"]}, {"id": "12.10.5", "levels": ["base"], "notes": "", "title": "The security incident response plan includes monitoring and responding to alerts from security monitoring systems.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.10.6", "levels": ["base"], "notes": "", "title": "The security incident response plan is modified and evolved according to lessons learned and to incorporate industry developments.", "description": "The effectiveness and accuracy of the incident response plan is reviewed and updated after\neach invocation.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.10.7", "levels": ["base"], "notes": "", "title": "Incident response procedures are in place, to be initiated upon the detection of stored PAN anywhere it is not expected.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "12.10", "levels": ["base"], "notes": "", "title": "Suspected and confirmed security incidents that could impact the CDE are responded to immediately.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["12.10.1", "12.10.2", "12.10.3", "12.10.4.1", "12.10.4", "12.10.5", "12.10.6", "12.10.7"]}, {"id": "A1.1.1", "levels": ["base"], "notes": "", "title": "Logical separation is implemented.", "description": "- The provider cannot access its customers' environments without authorization.\n- Customers cannot access the provider's environment without authorization.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A1.1.2", "levels": ["base"], "notes": "", "title": "Controls are implemented such that each customer only has permission to access its own cardholder data and CDE.", "description": "Customers cannot access other customers' environments.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A1.1.3", "levels": ["base"], "notes": "", "title": "Controls are implemented such that each customer can only access resources allocated to them.", "description": "Customers cannot impact resources allocated to other customers.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A1.1.4", "levels": ["base"], "notes": "", "title": "The effectiveness of logical separation controls used to separate customer environments is confirmed at least once every six months via penetration testing.", "description": "Segmentation of customer environments from other environments is periodically validated to\nbe effective. The testing of adequate separation between customers in a multi-tenant\nservice provider environment is in addition to the penetration tests specified in\nRequirement 11.4.6. This requirement is a best practice until 31 March 2025, after which\nit will be required and must be fully considered during a PCI DSS assessment.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A1.1", "levels": ["base"], "notes": "", "title": "Multi-tenant service providers protect and separate all customer environments and data.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A1.1.1", "A1.1.2", "A1.1.3", "A1.1.4"]}, {"id": "A1.2.1", "levels": ["base"], "notes": "", "title": "Audit log capability is enabled for each customer's environment that is consistent with PCI DSS Requirement 10.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A1.2.2", "levels": ["base"], "notes": "", "title": "Processes or mechanisms are implemented to support and/or facilitate prompt forensic investigations in the event of a suspected or confirmed security incident for any customer.", "description": "Forensic investigation is readily available to all customers in the event of a suspected\nor confirmed security incident.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A1.2.3", "levels": ["base"], "notes": "", "title": "Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A1.2", "levels": ["base"], "notes": "", "title": "Multi-tenant service providers facilitate logging and incident response for all customers.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A1.2.1", "A1.2.2", "A1.2.3"]}, {"id": "A2.1.1", "levels": ["base"], "notes": "Related to requirements 2.2.7 and 3.5.1.1.\nService level settings for web servers such as Apache and NGINX should also be checked.", "title": "Where POS POI terminals at the merchant or payment acceptance location use SSL and/or early TLS, the entity confirms the devices are not susceptible to any known exploits for those protocols.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": ["configure_openssl_crypto_policy", "configure_openssl_tls_crypto_policy", "harden_openssl_crypto_policy"], "rules": [], "controls": []}, {"id": "A2.1.2", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: All service providers with existing connection points to POS POI terminals that use SSL and/or early TLS as defined in A2.1 have a formal Risk Mitigation and Migration Plan in place.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A2.1.3", "levels": ["base"], "notes": "", "title": "Additional requirement for service providers only: All service providers provide a secure service offering.", "description": "This requirement is not eligible for the customized approach. This requirement applies\nonly when the entity being assessed is a service provider.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A2.1", "levels": ["base"], "notes": "", "title": "POI terminals using SSL and/or early TLS are confirmed as not susceptible to known SSL/TLS exploits.", "description": "Appendix A2: Additional PCI DSS Requirements for Entities Using SSL/Early TLS for\nCard-Present POS POI Terminal Connections.", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A2.1.1", "A2.1.2", "A2.1.3"]}, {"id": "A3.1.1", "levels": ["base"], "notes": "PCI DSS Reference: Requirement 12", "title": "Responsibility is established by executive management for the protection of account data and a PCI DSS compliance program.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.1.2", "levels": ["base"], "notes": "PCI DSS Reference: Requirements 1-12", "title": "A formal PCI DSS compliance program is in place.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.1.3", "levels": ["base"], "notes": "PCI DSS Reference: Requirement 12", "title": "PCI DSS compliance roles and responsibilities are specifically defined and formally assigned to one or more personnel.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.1.4", "levels": ["base"], "notes": "PCI DSS Reference: Requirement 12", "title": "Up-to-date PCI DSS and/or information security training is provided at least once every 12 months to personnel with PCI DSS compliance responsibilities (as identified in A3.1.3).", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.1", "levels": ["base"], "notes": "", "title": "A PCI DSS compliance program is implemented.", "description": "Appendix A3: Designated Entities Supplemental Validation (DESV)", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A3.1.1", "A3.1.2", "A3.1.3", "A3.1.4"]}, {"id": "A3.2.1", "levels": ["base"], "notes": "PCI DSS Reference: Scope of PCI DSS Requirements, Requirement 12.", "title": "PCI DSS scope is documented and confirmed for accuracy at least once every three months and upon significant changes to the in-scope environment.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.2.2.1", "levels": ["base"], "notes": "PCI DSS Reference: Scope of PCI DSS Requirements; Requirements 1-12", "title": "Upon completion of a change, all relevant PCI DSS requirements are confirmed to be implemented on all new or changed systems and networks, and documentation is updated as applicable.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.2.2", "levels": ["base"], "notes": "PCI DSS Reference: Scope of PCI DSS Requirements; Requirements 1-12", "title": "PCI DSS scope impact for all changes to systems or networks is determined, including additions of new systems and new network connections.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A3.2.2.1"]}, {"id": "A3.2.3", "levels": ["base"], "notes": "PCI DSS Reference: Requirement 12", "title": "Changes to organizational structure result in a formal (internal) review of the impact to PCI DSS scope and applicability of controls.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.2.4", "levels": ["base"], "notes": "PCI DSS Reference: Requirement 11", "title": "If segmentation is used, PCI DSS scope is confirmed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.2.5.1", "levels": ["base"], "notes": "PCI DSS Reference: Scope of PCI DSS Requirements.", "title": "Data discovery methods are confirmed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.2.5.2", "levels": ["base"], "notes": "", "title": "Response procedures are implemented to be initiated upon the detection of cleartext PAN outside the CDE.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.2.5", "levels": ["base"], "notes": "PCI DSS Reference: Scope of PCI DSS Requirements.", "title": "A data-discovery methodology is implemented.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A3.2.5.1", "A3.2.5.2"]}, {"id": "A3.2.6.1", "levels": ["base"], "notes": "PCI DSS Reference: Requirement 12", "title": "Response procedures are implemented to be initiated upon the detection of attempts to remove cleartext PAN from the CDE via an unauthorized channel, method, or process.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.2.6", "levels": ["base"], "notes": "PCI DSS Reference: Scope of PCI DSS Requirements, Requirement 12", "title": "Mechanisms are implemented for detecting and preventing cleartext PAN from leaving the CDE via an unauthorized channel, method, or process.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A3.2.6.1"]}, {"id": "A3.2", "levels": ["base"], "notes": "", "title": "PCI DSS scope is documented and validated.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A3.2.1", "A3.2.2.1", "A3.2.2", "A3.2.3", "A3.2.4", "A3.2.5.1", "A3.2.5.2", "A3.2.5", "A3.2.6.1", "A3.2.6"]}, {"id": "A3.3.1.2", "levels": ["base"], "notes": "PCI DSS Reference: Requirements 1-12\nIf you noticed, this requirement should be A3.3.1.1 instead of A3.3.1.2 but it was kept\nthis way to be aligned to the policy.", "title": "Failures of any critical security control systems are responded to promptly.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.3.1", "levels": ["base"], "notes": "PCI DSS Reference: Requirement 12", "title": "Failures of critical security control systems are detected, alerted, and addressed promptly.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A3.3.1.2"]}, {"id": "A3.3.2", "levels": ["base"], "notes": "PCI DSS Reference: Requirements 2, 6, 12.", "title": "Hardware and software technologies are reviewed at least once every 12 months to confirm whether they continue to meet the organization's PCI DSS requirements.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.3.3", "levels": ["base"], "notes": "PCI DSS Reference: Requirements 1-12.", "title": "Reviews are performed at least once every three months to verify BAU activities are being followed.", "description": "Reviews are performed by personnel assigned to the PCI DSS compliance program (as\nidentified in A3.1.3).", "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.3", "levels": ["base"], "notes": "", "title": "PCI DSS is incorporated into business-as-usual (BAU) activities.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A3.3.1.2", "A3.3.1", "A3.3.2", "A3.3.3"]}, {"id": "A3.4.1", "levels": ["base"], "notes": "PCI DSS Reference: Requirement 7.", "title": "User accounts and access privileges to in-scope system components are reviewed at least once every six months to ensure user accounts and access privileges remain appropriate based on job function, and that all access is authorized.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.4", "levels": ["base"], "notes": "", "title": "Logical access to the cardholder data environment is controlled and managed.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A3.4.1"]}, {"id": "A3.5.1", "levels": ["base"], "notes": "PCI DSS Reference: Requirement 10, 12.", "title": "A methodology is implemented for the prompt identification of attack patterns and undesirable behavior across systems.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": []}, {"id": "A3.5", "levels": ["base"], "notes": "", "title": "Suspicious events are identified and responded to.", "description": null, "rationale": null, "automated": "no", "status": "manual", "mitigation": null, "artifact_description": null, "status_justification": null, "fixtext": null, "check": null, "tickets": null, "original_title": null, "related_rules": [], "rules": [], "controls": ["A3.5.1"]}], "levels": [{"id": "base", "inherits_from": null}]}