Pci Dss 3.0 Requirement 4

Front 1

7.1

Back 1

Limit access to system components and cardholder data to only those individuals whose job requires such access.

Front 2

7.2

Back 2

Establish an access control system for systems components that restricts access based on a user’s need to know, and is set to “deny all” unless specifi cally allowed.

Front 3

7.3

Back 3

Ensure that related security policies and operational procedures are documented, in use, and known to all affected parties.

Front 4

8.1

Back 4

Define and implement policies and procedures to ensure proper user identifi cation management for users and administrators on all system components. Assign all users a unique user name before allowing them to access system components or cardholder data.

Front 5

8.2

Back 5

Employ at least one of these to authenticate all users: something you know, such as a password or passphrase; something you have, such as a token device or smart card; or something you are, such as a biometric. Use strong authentication methods and render all passwords unreadable during transmission and storage using strong cryptography.

Front 6

8.3

Back 6

Implement two-factor authentication for all remote network access that originates from outside the network, by employees, administrators, and third parties including vendor access for support or maintenance. Examples of two-factor technologies include remote authentication and dial-in service (RADIUS) with tokens; terminal access controller access control system (TACACS) with tokens; or other technologies that facilitate two-factor authentication. Using one factor twice (e.g. using two separate passwords) is not considered two-factor authentication.

Front 7

8.4

Back 7

Develop, implement, and communicate authentication procedures and policies to all users.

Front 8

8.5

Back 8

Do not use group, shared, or generic IDs, or other authentication methods. Service providers with access to customer environments must use a unique authentication credential (such as a password/passphrase) for each customer environment. (Note: This requirement for service providers is a best practice until June 30, 2015, after which it becomes a requirement.)

Front 9

8.6

Back 9

Use of other authentication mechanisms such as physical security tokens, smart cards, and certificates must be assigned to an individual account.

Front 10

8.7

Back 10

All access to any database containing cardholder data must be restricted: all user access must be through programmatic methods; only database administrators can have direct or query access; and application IDs for database applications can only be used by the applications (and not by users or non-application processes).

Front 11

8.8

Back 11

Ensure that related security policies and operational procedures are documented, in use, and known to all aff ected parties

Front 12

9.1

Back 12

Use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment.

Front 13

9.2

Back 13

Develop procedures to easily distinguish between onsite personnel and visitors, such as assigning ID badges.

Front 14

9.3

Back 14

Control physical access for onsite personnel to the sensitive areas. Access must be authorized and based on individual job function; access must be revoked immediately upon termination, and all physical access mechanisms, such as keys, access cards, etc. returned or disabled.

Front 15

9.4

Back 15

Ensure all visitors are authorized before entering areas where cardholder data is processed or maintained; given a physical token that expires and that identifi es visitors as not onsite personnel; and are asked to surrender the physical token before leaving the facility or at the date of expiration. Use a visitor log to maintain a physical audit trail of visitor information and activity, including visitor name, company, and the onsite personnel authorizing physical access. Retain the log for at least three months unless otherwise restricted by law.

Front 16

9.5

Back 16

Physically secure all media; store media back-ups in a secure location, preferably off site.

Front 17

9.6

Back 17

Maintain strict control over the internal or external distribution of any kind of media.

Front 18

9.7

Back 18

Maintain strict control over the storage and accessibility of media.

Front 19

9.8

Back 19

Destroy media when it is no longer needed for business or legal reasons.

Front 20

9.9

Back 20

Protect devices that capture payment card data via direct physical interaction with the card from tampering and substitution. This includes periodic inspections of POS device surfaces to detect tampering, and training personnel to be aware of suspicious activity. (Note: Requirement 9.9 is a best practice until June 30, 2015, after which it becomes a requirement.)

Front 21

9.10

Back 21

Ensure that related security policies and operational procedures are documented, in use, and known to all aff ected parties