anchor.diff:  - Risk-assessment results and risk-reduction controls in place;<br>
   - Description of processes to monitor for new vulnerabilities associated with SSL/early TLS;<br>
   - Description of change control processes that are implemented to ensure SSL/early TLS is not implemented into new environments;<br>
  -- Overview of migration project plan including target migration completion date no later than June 30, 2016.","Enabling security features before new servers are deployed will prevent servers being installed into the environment with insecure configurations.<br> Ensuring that all insecure services, protocols, and daemons are adequately secured with appropriate security features makes it more difficult for malicious individuals to take advantage of commonly used points of compromise within a network.<br> Refer to industry standards and best practices for information on strong cryptography and secure protocols (e.g., NIST SP 800-52 and SP 800-57, OWASP, etc.).<br><br> Regarding use of SSL/early TLS: Entities using SSL and early TLS must work towards upgrading to a strong cryptographic protocol as soon as possible. Additionally, SSL and/or early TLS must not be introduced into environments where they don’t already exist. At the time of publication, the known vulnerabilities are difficult to exploit in POS POI payment environments. However, new vulnerabilities could emerge at any time, and it is up to the organization to remain up-to-date with vulnerability trends and determine whether or not they are susceptible to any known exploits.<br> Refer to the PCI SSC Information Supplement Migrating from SSL and Early TLS for further guidance on the use of SSL/early TLS.",,PCI Program
  -,PCI 2.2.4,PCI 2.2.4 System Security Perimeters,2.2.4 Configure system security parameters to prevent misuse.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,2.2.4.a Interview system administrators and/or security managers to verify that they have knowledge of common security parameter settings for system components.<br><br>2.2.4.b Examine the system configuration standards to verify that common security parameter settings are included.<br><br>2.2.4.c Select a sample of system components and inspect the common security parameters to verify that they are set appropriately and in accordance with the configuration standards.,"System configuration standards and related processes should specifically address security settings and parameters that have known security implications for each type of system in use.<br> In order for systems to be configured securely, personnel responsible for configuration and/or administering systems must be knowledgeable in the specific security parameters and settings that apply to the system.",,PCI Program
  -,PCI 2.2.5,PCI 2.2.5 Remove Unnecessary Functionality,"2.2.5 Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.2.5.a Select a sample of system components and inspect the configurations to verify that all unnecessary functionality (for example, scripts, drivers, features, subsystems, file systems, etc.) is removed.<br><br>2.2.5.b. Examine the documentation and security parameters to verify enabled functions are documented and support secure configuration.<br><br>2.2.5.c. Examine the documentation and security parameters to verify that only documented functionality is present on the sampled system components.","Unnecessary functions can provide additional opportunities for malicious individuals to gain access to a system. By removing unnecessary functionality, organizations can focus on securing the functions that are required and reduce the risk that unknown functions will be exploited.<br> Including this in server-hardening standards and processes addresses the specific security implications associated with unnecessary functions (for example, by removing/disabling FTP or the web server if the server will not be performing those functions).",,PCI Program
  +- Overview of migration project plan including target migration completion date no later than June 30, 2016.","Enabling security features before new servers are deployed will prevent servers being installed into the environment with insecure configurations.<br> Ensuring that all insecure services, protocols, and daemons are adequately secured with appropriate security features makes it more difficult for malicious individuals to take advantage of commonly used points of compromise within a network.<br> Refer to industry standards and best practices for information on strong cryptography and secure protocols (e.g., NIST SP 800-52 and SP 800-57, OWASP, etc.).<br><br> Regarding use of SSL/early TLS: Entities using SSL and early TLS must work towards upgrading to a strong cryptographic protocol as soon as possible. Additionally, SSL and/or early TLS must not be introduced into environments where they don’t already exist. At the time of publication, the known vulnerabilities are difficult to exploit in POS POI payment environments. However, new vulnerabilities could emerge at any time, and it is up to the organization to remain up-to-date with vulnerability trends and determine whether or not they are susceptible to any known exploits.<br> Refer to the PCI SSC Information Supplement Migrating from SSL and Early TLS for further guidance on the use of SSL/early TLS.",PCI Program
  +,PCI 2.2.4,PCI 2.2.4 System Security Perimeters,2.2.4 Configure system security parameters to prevent misuse.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,2.2.4.a Interview system administrators and/or security managers to verify that they have knowledge of common security parameter settings for system components.<br><br>2.2.4.b Examine the system configuration standards to verify that common security parameter settings are included.<br><br>2.2.4.c Select a sample of system components and inspect the common security parameters to verify that they are set appropriately and in accordance with the configuration standards.,"System configuration standards and related processes should specifically address security settings and parameters that have known security implications for each type of system in use.<br> In order for systems to be configured securely, personnel responsible for configuration and/or administering systems must be knowledgeable in the specific security parameters and settings that apply to the system.",PCI Program
  +,PCI 2.2.5,PCI 2.2.5 Remove Unnecessary Functionality,"2.2.5 Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.2.5.a Select a sample of system components and inspect the configurations to verify that all unnecessary functionality (for example, scripts, drivers, features, subsystems, file systems, etc.) is removed.<br><br>2.2.5.b. Examine the documentation and security parameters to verify enabled functions are documented and support secure configuration.<br><br>2.2.5.c. Examine the documentation and security parameters to verify that only documented functionality is present on the sampled system components.","Unnecessary functions can provide additional opportunities for malicious individuals to gain access to a system. By removing unnecessary functionality, organizations can focus on securing the functions that are required and reduce the risk that unknown functions will be exploited.<br> Including this in server-hardening standards and processes addresses the specific security implications associated with unnecessary functions (for example, by removing/disabling FTP or the web server if the server will not be performing those functions).",PCI Program
   ,PCI 2.3,PCI 2.3 Encryption,"2.3 Encrypt all non-console administrative access using strong cryptography. Use technologies such as SSH, VPN, or TLS for web-based management and other non-console administrative access.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.3 Select a sample of system components and verify that non-console administrative access is encrypted by performing the following:<br><br>
   
   2.3.a Observe an administrator log on to each system and examine system configurations to verify that a strong encryption method is invoked before the administrator’s password is requested.<br><br>
   ￼￼￼
  -2.3.b Review services and parameter files on systems to determine that Telnet and other insecure remote-login commands are not available for non-console access.","If non-console (including remote) administration does not use secure authentication and encrypted communications, sensitive administrative or operational level information (like administrator’s IDs and passwords) can be revealed to an eavesdropper. A malicious individual could use this information to access the network, become administrator, and steal data.<br> Clear-text protocols (such as HTTP, telnet, etc.) do not encrypt traffic or logon details, making it easy for an eavesdropper to intercept this information.<br> To be considered “strong cryptography,” industryrecognized protocols with appropriate key strengths and key management should be in place as applicable for the type of technology in use. (Refer to ""strong cryptography” in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms, and industry standards and best practices such as NIST SP 800-52 and SP 800-57, OWASP, etc.)<br> Regarding use of SSL/early TLS: Entities using SSL and early TLS must work towards upgrading to a strong cryptographic protocol as soon as possible. Additionally, SSL and/or early TLS must not be introduced into environments where they don’t already exist. At the time of publication, the known vulnerabilities are difficult to exploit in POS POI payment environments. However, new vulnerabilities could emerge at any time, and it is up to the organization to remain up-to-date with vulnerability trends and determine whether or not they are susceptible to any known exploits.<br> Refer to the PCI SSC Information Supplement Migrating from SSL and Early TLS for further guidance on the use of SSL/early TLS.",,PCI Program
  -,PCI 2.4,PCI 2.4 Inventory of System Components,2.4 Maintain an inventory of system components that are in scope for PCI DSS.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,2.4.a Examine system inventory to verify that a list of hardware and software components is maintained and includes a description of function/use for each.<br><br>2.4.b Interview personnel to verify the documented inventory is kept current.,"Maintaining a current list of all system components will enable an organization to accurately and efficiently define the scope of their environment for implementing PCI DSS controls. Without an inventory, some system components could be forgotten, and be inadvertently excluded from the organization’s configuration standards.",,PCI Program
  -,PCI 2.5,PCI 2.5 Examine Documentation and Interview Personnel,"2.5 Ensure that security policies and operational procedures for managing vendor defaults and other security parameters are documented, in use, and known to all affected parties.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.5 Examine documentation and interview personnel to verify that security policies and operational procedures for managing vendor defaults and other security parameters are:<br><br>·    Documented,<br>·    In use, and<br>·    Known to all affected parties.",Personnel need to be aware of and following security policies and daily operational procedures to ensure vendor defaults and other security parameters are continuously managed to prevent insecure configurations.,,PCI Program
  -,PCI 2.6,PCI 2.6 Testing Procedures,2.6 Shared hosting providers must protect each entity’s hosted environment and cardholder data. These providers must meet specific requirements as detailed in Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.6 Perform testing procedures A.1.1 through A.1.4 detailed in Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers for PCI DSS assessments of shared hosting providers, to verify that shared hosting providers protect their entities’ (merchants and service providers) hosted environment and data.","This is intended for hosting providers that provide shared hosting environments for multiple clients on the same server. When all data is on the same server and under control of a single environment, often the settings on these shared servers are not manageable by individual clients. This allows clients to add insecure functions and scripts that impact the security of all other client environments; and thereby make it easy for a malicious individual to compromise one client's data and thereby gain access to all other clients' data. See Appendix A for details of requirements.",,PCI Program
  -,,,,,,,,,,,,,,,,,,,,,,,,,,
  -Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,,
  -Objective,Code*,Title*,Description,Notes,Owner*,State,Primary Contact,Secondary Contact,Objective URL,Reference URL,map:control,map:program,,,,,,,,,,,,,,
  +2.3.b Review services and parameter files on systems to determine that Telnet and other insecure remote-login commands are not available for non-console access.","If non-console (including remote) administration does not use secure authentication and encrypted communications, sensitive administrative or operational level information (like administrator’s IDs and passwords) can be revealed to an eavesdropper. A malicious individual could use this information to access the network, become administrator, and steal data.<br> Clear-text protocols (such as HTTP, telnet, etc.) do not encrypt traffic or logon details, making it easy for an eavesdropper to intercept this information.<br> To be considered “strong cryptography,” industryrecognized protocols with appropriate key strengths and key management should be in place as applicable for the type of technology in use. (Refer to ""strong cryptography” in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms, and industry standards and best practices such as NIST SP 800-52 and SP 800-57, OWASP, etc.)<br> Regarding use of SSL/early TLS: Entities using SSL and early TLS must work towards upgrading to a strong cryptographic protocol as soon as possible. Additionally, SSL and/or early TLS must not be introduced into environments where they don’t already exist. At the time of publication, the known vulnerabilities are difficult to exploit in POS POI payment environments. However, new vulnerabilities could emerge at any time, and it is up to the organization to remain up-to-date with vulnerability trends and determine whether or not they are susceptible to any known exploits.<br> Refer to the PCI SSC Information Supplement Migrating from SSL and Early TLS for further guidance on the use of SSL/early TLS.",PCI Program
  +,PCI 2.4,PCI 2.4 Inventory of System Components,2.4 Maintain an inventory of system components that are in scope for PCI DSS.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,2.4.a Examine system inventory to verify that a list of hardware and software components is maintained and includes a description of function/use for each.<br><br>2.4.b Interview personnel to verify the documented inventory is kept current.,"Maintaining a current list of all system components will enable an organization to accurately and efficiently define the scope of their environment for implementing PCI DSS controls. Without an inventory, some system components could be forgotten, and be inadvertently excluded from the organization’s configuration standards.",PCI Program
  +,PCI 2.5,PCI 2.5 Examine Documentation and Interview Personnel,"2.5 Ensure that security policies and operational procedures for managing vendor defaults and other security parameters are documented, in use, and known to all affected parties.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.5 Examine documentation and interview personnel to verify that security policies and operational procedures for managing vendor defaults and other security parameters are:<br><br>·    Documented,<br>·    In use, and<br>·    Known to all affected parties.",Personnel need to be aware of and following security policies and daily operational procedures to ensure vendor defaults and other security parameters are continuously managed to prevent insecure configurations.,PCI Program
  +,PCI 2.6,PCI 2.6 Testing Procedures,2.6 Shared hosting providers must protect each entity’s hosted environment and cardholder data. These providers must meet specific requirements as detailed in Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.6 Perform testing procedures A.1.1 through A.1.4 detailed in Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers for PCI DSS assessments of shared hosting providers, to verify that shared hosting providers protect their entities’ (merchants and service providers) hosted environment and data.","This is intended for hosting providers that provide shared hosting environments for multiple clients on the same server. When all data is on the same server and under control of a single environment, often the settings on these shared servers are not manageable by individual clients. This allows clients to add insecure functions and scripts that impact the security of all other client environments; and thereby make it easy for a malicious individual to compromise one client's data and thereby gain access to all other clients' data. See Appendix A for details of requirements.",PCI Program
  +,,,,,,,,,,,,,,,,,,,,,,,,,
  +Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,
  +Objective,Code*,Title*,Description,Notes,Owner*,State,Primary Contact,Secondary Contact,Objective URL,Reference URL,map:control,map:program,,,,,,,,,,,,,
   ,01_PCI,PCI Requirement 1 - Firewall Configuration,Install and maintain a firewall configuration to protect cardholder data,,albert@reciprocitylabs.com,Draft,,,,,"PCI 1.1
   PCI 1.2
   PCI 1.2.1
  
positive.code: Perform a Risk Assessment (Annually)
  Perform Periodic Tasks as Required
  Procure an ASV Vendor
  ","The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, ATM, and POS cards.",miha@reciprocitylabs.com,,,,,Draft,,,,,https://www.pcisecuritystandards.org/,https://www.pcisecuritystandards.org/,,,,,,,,,,
  ,SOC2/3,2014: SOC 2/3 - Audit 1,,,miha@reciprocitylabs.com,,,,,Draft,,,,,,,,,,,,,,,,
  ,Consolidated,SOC program,,,miha@reciprocitylabs.com,,,,,Draft,,,,,,,,,,,,,,,,
  ,,,,,,,,,,,,,,,,,,,,,,,,,,
  Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,,
  Control,Code*,Title*,Description,,,Owner*,Effective Date,Stop Date,State,Assertions,Categories,Primary Contact,Fraud Related,Significance,Kind/Nature,Type/Means,Principal Assessor,Secondary Assessor,Secondary Contact,Control URL,Reference URL,Frequency,Test Plan,Notes,map:audit,map:program
  ,PCI 1.1,PCI 1.1 Firewall and Router Configuration,"1.1 Establish and implement firewall and router configuration standards that include the following:<br><br>
  
  1.1.1 A formal process for approving and testing all network connections and changes to the firewall and router configurations<br><br>
  
negative.code: 
  1.1.6 Documentation and business justification for use of all services, protocols, and ports allowed, including documentation of security features implemented for those protocols considered to be insecure.<br>Examples of insecure services, protocols, or ports include but are not limited to FTP, Telnet, POP3, IMAP, and SNMP v1 and v2.<br><br>
  
  1.1.7 Requirement to review firewall and router rule sets at least every six months",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.1 Inspect the firewall and router configuration standards and other documentation specified below and verify that standards are complete and implemented as follows:<br><br>1.1.1.a Examine documented procedures to verify there is a formal process for testing and approval of all:<br><br>1) Network connections and<br>2) Changes to firewall and router configurations<br>1.1.1.b For a sample of network connections, interview responsible personnel and examine records to verify that network connections were approved and tested.<br>1.1.1.c Identify a sample of actual changes made to firewall and router configurations, compare to the change records, and interview responsible personnel to verify the changes were approved and tested.<br><br>1.1.2.a Examine diagram(s) and observe network configurations to verify that a current network diagram exists and that it documents all connections to cardholder data, including any wireless networks.<br>1.1.2.b Interview responsible personnel to verify that the diagram is kept current.<br><br>1.1.3 Examine data-flow diagram and interview personnel to verify the diagram:<br>• Shows all cardholder data flows across systems and networks.<br>• Is kept current and updated as needed upon changes to the environment.<br><br>1.1.4.a Examine the firewall configuration standards and verify that they include requirements for a firewall at each Internet connection and between any DMZ and the internal network zone.<br>1.1.4.b Verify that the current network diagram is consistent with the firewall configuration standards.<br>1.1.4.c Observe network configurations to verify that a firewall is in place at each Internet connection and between any demilitarized zone (DMZ) and the internal network zone, per the documented configuration standards and network diagrams.<br><br>1.1.5.a Verify that firewall and router configuration standards include a description of groups, roles, and responsibilities for management of network components.<br>1.1.5.b Interview personnel responsible for management of network components to confirm that roles and responsibilities are assigned as documented.<br><br>1.1.6.a Verify that firewall and router configuration standards include a documented list of all services, protocols and ports, including business justification for each—for example, hypertext transfer protocol (HTTP) and Secure Sockets Layer (SSL), Secure Shell (SSH), and Virtual Private Network (VPN) protocols.<br>1.1.6.b Identify insecure services, protocols, and ports allowed; and verify that security features are documented for each service.<br>1.1.6.c Examine firewall and router configurations to verify that the documented security features are implemented for each insecure service, protocol, and port.<br><br>1.1.7.a Verify that firewall and router configuration standards require review of firewall and router rule sets at least every six months.<br><br>1.1.7.b Examine documentation relating to rule set reviews and interview responsible personnel to verify that the rule sets are reviewed at least every six months.","1.1.2 Network diagrams describe how networks are configured, and identify the location of all network devices. Without current network diagrams, devices could be overlooked and be unknowingly left out of the security controls implemented for PCI DSS and thus be vulnerable to compromise. <br><br> 1.1.3 Cardholder data-flow diagrams identify the location of all cardholder data that is stored, processed, or transmitted within the network. Network and cardholder data-flow diagrams help an organization to understand and keep track of the scope of their environment, by showing how cardholder data flows across networks and between individual systems and devices. <br><br> 1.1.4 Using a firewall on every Internet connection coming into (and out of) the network, and between any DMZ and the internal network, allows the organization to monitor and control access and minimizes the chances of a malicious individual obtaining access to the internal network via an unprotected connection.<br><br> 1.1.5 This description of roles and assignment of responsibilities ensures that personnel are aware of who is responsible for the security of all network components, and that those assigned to manage components are aware of their responsibilities. If roles and responsibilities are not formally assigned, devices could be left unmanaged. <br><br> 1.1.6 Compromises often happen due to unused or insecure service and ports, since these often have known vulnerabilities and many organizations don’t patch vulnerabilities for the services, protocols, and ports they don't use (even though the vulnerabilities are still present). By clearly defining and documenting the services, protocols, and ports that are necessary for business, organizations can ensure that all other services, protocols, and ports are disabled or removed. If insecure services, protocols, or ports are necessary for business, the risk posed by use of these protocols should be clearly understood and accepted by the organization, the use of the protocol should be justified, and the security features that allow these protocols to be used securely should be documented and implemented. If these insecure services, protocols, or ports are not necessary for business, they should be disabled or removed. <br><br> 1.1.7 This review gives the organization an opportunity at least every six months to clean up any unneeded, outdated, or incorrect rules, and ensure that all rule sets allow only authorized services and ports that match the documented business justifications. Organizations with a high volume of changes to firewall and router rule sets may wish to consider performing reviews more frequently, to ensure that the rule sets continue to meet the needs of the business.",PCI Program
  ,PCI 1.2,PCI 1.2 Firewall and Router Connections Configuration,"1.2 Build firewall and router configurations that restrict connections between untrusted networks and any system components in the cardholder data environment.<br><br>
  
  Note: An “untrusted network” is any network that is external to the networks belonging to the entity under review, and/or which is out of the entity's ability to control or manage.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,1.2 Examine firewall and router configurations and perform the following to verify that connections are restricted between untrusted networks and system components in the cardholder data environment:,"It is essential to install network protection between the internal, trusted network and any untrusted network that is external and/or out of the entity’s ability to control or manage. Failure to implement this measure correctly results in the entity being vulnerable to unauthorized access by malicious individuals or software.<br> For firewall functionality to be effective, it must be properly configured to control and/or limit traffic into and out of the entity’s network.",PCI Program
  ,PCI 1.2.1,PCI 1.2.1 Traffic Restrictions,"1.2.1 Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.2.1.a Examine firewall and router configuration standards to verify that they identify inbound and outbound traffic necessary for the cardholder data environment.<br><br>1.2.1.b Examine firewall and router configurations to verify that inbound and outbound traffic is limited to that which is necessary for the cardholder data environment.<br><br>1.2.1.c Examine firewall and router configurations to verify that all other inbound and outbound traffic is specifically denied, for example by using an explicit “deny all” or an implicit deny after allow statement.","This requirement is intended to prevent malicious individuals from accessing the entity’s network via unauthorized IP addresses or from using services, protocols, or ports in an unauthorized manner (for example, to send data they've obtained from within your network out to an untrusted server).<br> Implementing a rule that denies all inbound and outbound traffic that is not specifically needed helps to prevent inadvertent holes that would allow unintended and potentially harmful traffic in or out.",PCI Program
  ,PCI 1.2.2,PCI 1.2.2 Secure and Synchronize,1.2.2 Secure and synchronize router configuration files.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.2.2.a Examine router configuration files to verify they are secured from unauthorized access.<br><br>1.2.2.b Examine router configurations to verify they are synchronized—for example, the running (or active) configuration matches the start-up configuration (used when machines are booted).","While the running (or active) router configuration files include the current, secure settings, the startup files (which are used when routers are restarted or booted) must be updated with the same secure settings to ensure these settings are applied when the start-up configuration is run.<br> Because they only run occasionally, start-up configuration files are often forgotten and are not updated. When a router re-starts and loads a start-up configuration that has not been updated with the same secure settings as those in the running configuration, it may result in weaker rules that allow malicious individuals into the network.",PCI Program
  ,PCI 1.2.3,PCI 1.2.3 Perimeter Firewalls,"1.2.3 Install perimeter firewalls between all wireless networks and the cardholder data environment, and configure these firewalls to deny or, if traffic is necessary for business purposes, permit only authorized traffic between the wireless environment and the cardholder data environment.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.2.3.a Examine firewall and router configurations to verify that there are perimeter firewalls installed between all wireless networks and the cardholder data environment.<br><br>1.2.3.b Verify that the firewalls deny or, if traffic is necessary for business purposes, permit only authorized traffic between the wireless environment and the cardholder data environment.","The known (or unknown) implementation and exploitation of wireless technology within a network is a common path for malicious individuals to gain access to the network and cardholder data. If a wireless device or network is installed without the entity’s knowledge, a malicious individual could easily and “invisibly” enter the network. If firewalls do not restrict access from wireless networks into the CDE, malicious individuals that gain unauthorized access to the wireless network can easily connect to the CDE and compromise account information.<br> Firewalls must be installed between all wireless networks and the CDE, regardless of the purpose of the environment to which the wireless network is connected. This may include, but is not limited to, corporate networks, retail stores, guest networks, warehouse environments, etc.",PCI Program
  ,PCI 1.3,PCI 1.3 Examine Router and Firewall Configurations,1.3 Prohibit direct public access between the Internet and any system component in the cardholder data environment.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.3 Examine firewall and router configurations—including but  not limited to the choke router at the Internet, the DMZ router and firewall, the DMZ cardholder segment, the perimeter router, and the internal cardholder network segment—and perform the following to determine that there is no direct access between the Internet and system components in the internal cardholder network segment:","A firewall's intent is to manage and control all connections between public systems and internal systems, especially those that store, process or transmit cardholder data. If direct access is allowed between public systems and the CDE, the protections offered by the firewall are bypassed, and system components storing cardholder data may be exposed to compromise.",PCI Program
  ,PCI 1.3.1,PCI 1.3.1 DMZ to Limit Inbound Traffic,"1.3.1 Implement a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.3.1 Examine firewall and router configurations to verify that a DMZ is implemented to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.","The DMZ is that part of the network that manages connections between the Internet (or other untrusted networks), and services that an organization needs to have available to the public (like a web server).<br> This functionality is intended to prevent malicious individuals from accessing the organization's internal network from the Internet, or from using services, protocols, or ports in an unauthorized manner.",PCI Program
  ,PCI 1.3.2,PCI 1.3.2 DMZ Limiting IP Addresses,1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,1.3.2 Examine firewall and router configurations to verify that inbound Internet traffic is limited to IP addresses within the DMZ.,"The DMZ is that part of the network that manages connections between the Internet (or other untrusted networks), and services that an organization needs to have available to the public (like a web server).<br> This functionality is intended to prevent malicious individuals from accessing the organization's internal network from the Internet, or from using services, protocols, or ports in an unauthorized manner.",PCI Program
  ,PCI 1.3.3,PCI 1.3.3 Direct Connections Prohibited,1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,1.3.3 Examine firewall and router configurations to verify direct connections inbound or outbound are not allowed for traffic between the Internet and the cardholder data environment.,"Examination of all inbound and outbound connections allows for inspection and restriction of traffic based on the source and/or destination address, as well as inspection and blocking of unwanted content, thus preventing unfiltered access between untrusted and trusted environments. This helps prevent, for example, malicious individuals from sending data they've obtained from within your network out to an external untrusted server in an untrusted network.",PCI Program
  ,PCI 1.3.4,PCI 1.3.4 Anti-Spoofing,"1.3.4 Implement anti-spoofing measures to detect and block forged source IP addresses from entering the network.<br>(For example, block traffic originating from the Internet with an internal source address.)",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.3.4 Examine firewall and router configurations to verify that anti-spoofing measures are implemented, for example internal addresses cannot pass from the Internet into the DMZ.","Normally a packet contains the IP address of the computer that originally sent it so other computers in the network know where the packet came from. Malicious individuals will often try to spoof (or imitate) the sending IP address so that the target system believes the packet is from a trusted source.<br> Filtering packets coming into the network helps to, among other things, ensure packets are not “spoofed” to look like they are coming from an organization’s own internal network.",PCI Program
  ,PCI 1.3.5,PCI 1.3.5 Outbound Traffic Authorized,1.3.5 Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,1.3.5 Examine firewall and router configurations to verify that outbound traffic from the cardholder data environment to the Internet is explicitly authorized.,"All traffic outbound from the cardholder data environment should be evaluated to ensure that it follows established, authorized rules. Connections should be inspected to restrict traffic to only authorized communications (for example by restricting source/destination addresses/ports, and/or blocking of content).",PCI Program
  ,PCI 1.3.6,PCI 1.3.6 Stateful Inspection,"1.3.6 Implement stateful inspection, also known as dynamic packet filtering. (That is, only “established” connections are allowed into the network.)",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.3.6 Examine firewall and router configurations to verify that the firewall performs stateful inspection (dynamic packet filtering). (Only established connections should be allowed in, and only if they are associated with a previously established session.)","A firewall that performs stateful packet inspection maintains the ""state"" (or the status) for each connection through the firewall. By maintaining the “state,” the firewall knows whether an apparent response to a previous connection is actually a valid, authorized response (since it retains each connection’s status) or is malicious traffic trying to trick the firewall into allowing the connection.",PCI Program
  ,PCI 1.3.7,PCI 1.3.7 Internal Network Zone,"1.3.7 Place system components that store cardholder data (such as a database) in an internal network zone, segregated from the DMZ and other untrusted networks.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.3.7 Examine firewall and router configurations to verify that system components that store cardholder data are on an internal network zone, segregated from the DMZ and other untrusted networks.","If cardholder data is located within the DMZ, it is easier for an external attacker to access this information, since there are fewer layers to penetrate. Securing system components that store cardholder data in an internal network zone that is segregated from the DMZ and other untrusted networks by a firewall can prevent unauthorized network traffic from reaching the system component.<br> Note: This requirement is not intended to apply to temporary storage of cardholder data in volatile memory.",PCI Program
  ,PCI 1.3.8,PCI 1.3.8 Do Not Disclose to Unauthorized Parties,"1.3.8 Do not disclose private IP addresses and routing information to unauthorized parties.<br> Note: Methods to obscure IP addressing may include, but are not limited to:<br> • Network Address Translation (NAT)<br>• Placing servers containing cardholder data behind proxy servers/firewalls,<br>• Removal or filtering of route advertisements for private networks that employ registered addressing,<br>• Internal use of RFC1918 address space instead of registered addresses.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,1.3.8.a Examine firewall and router configurations to verify that methods are in place to prevent the disclosure of private IP addresses and routing information from internal networks to the Internet.<br><br>1.3.8.b Interview personnel and examine documentation to verify that any disclosure of private IP addresses and routing information to external entities is authorized.,"Restricting the disclosure of internal or private IP addresses is essential to prevent a hacker “learning” the IP addresses of the internal network, and using that information to access the network.<br> Methods used to meet the intent of this requirement may vary depending on the specific networking technology being used. For example, the controls used to meet this requirement may be different for IPv4 networks than for IPv6 networks.",PCI Program
  ,PCI 1.4,PCI 1.4 Personal Firewall Software,"1.4 Install personal firewall software on any mobile and/or employee-owned devices that connect to the Internet when outside the network (for example, laptops used by employees), and which are also used to access the network. Firewall configurations include:<br>• Specific configuration settings are defined for personal firewall software.<br>• Personal firewall software is actively running.<br>• Personal firewall software is not alterable by users of mobile and/or employee-owned devices.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.4.a Examine policies and configuration standards to verify:<br>• Personal firewall software is required for all mobile and/or employee-owned devices that connect to the Internet (for example, laptops used by employees) when outside the network, and which are also used to access the network.<br>• Specific configuration settings are defined for personal firewall software.<br>• Personal firewall software is configured to actively run.<br>• Personal firewall software is configured to not be alterable by users of mobile and/or employee-owned devices.<br><br>1.4.b Inspect a sample of mobile and/or employee-owned devices to verify that:<br>• Personal firewall software is installed and configured per the organization’s specific configuration settings.<br>• Personal firewall software is actively running.<br>• Personal firewall software is not alterable by users of mobile and/or employee-owned devices.","Portable computing devices that are allowed to connect to the Internet from outside the corporate firewall are more vulnerable to Internet-based threats. Use of a personal firewall helps to protect devices from Internet-based attacks, which could use the device to gain access the organization’s systems and data once the device is re-connected to the network.<br> The specific firewall configuration settings are determined by the organization.<br> Note: The intent of this requirement applies to employee-owned and company-owned computers. Systems that cannot be managed by corporate policy introduce weaknesses to the perimeter and provide opportunities that malicious individuals may exploit. Allowing untrusted systems to connect to an organization’s network could result in access being granted to attackers and other malicious users.",PCI Program
  ,PCI 1.5,PCI 1.5 Managing Firewalls,"1.5 Ensure that security policies and operational procedures for managing firewalls are documented, in use, and known to all affected parties.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"1.5 Examine documentation and interview personnel to verify that security policies and operational procedures for managing firewalls are:<br>• Documented,<br>• In use, and<br>• Known to all affected parties.",Personnel need to be aware of and following security policies and operational procedures to ensure firewalls and routers are continuously managed to prevent unauthorized access to the network.,PCI Program
  ,PCI 2.1,PCI 2.1 Change Vendor-Supplied Defaults,"2.1 Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network. <br>
  This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP) community strings, etc.).",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.1.a Choose a sample of system components, and attempt to log on (with system administrator help) to the devices and applications using default vendor-supplied accounts and passwords, to verify that ALL default passwords (including those on operating systems, software that provides security services, application and system accounts, POS terminals, and Simple Network Management Protocol (SNMP) community strings) have been changed. (Use vendor manuals and sources on the Internet to find vendor-supplied accounts/passwords.)<br><br>2.1.b For the sample of system components, verify that all unnecessary default accounts (including accounts used by operating systems, security software, applications, systems, POS terminals, SNMP, etc.) are removed or disabled.<br><br>2.1.c Interview personnel and examine supporting documentation to verify that:<br>• All vendor defaults (including default passwords on operating systems, software providing security services, application and system accounts, POS terminals, Simple Network Management Protocol (SNMP) community strings, etc.) are changed before a system is installed on the network.<br>• Unnecessary default accounts (including accounts used by operating systems, security software, applications, systems, POS terminals, SNMP, etc.) are removed or disabled before a system is installed on the network.","Malicious individuals (external and internal to an organization) often use vendor default settings, account names, and passwords to compromise operating system software, applications, and the systems on which they are installed. Because these default settings are often published and are well known in hacker communities, changing these settings will leave systems less vulnerable to attack.<br> Even if a default account is not intended to be used, changing the default password to a strong unique password and then disabling the account will prevent a malicious individual from re-enabling the account and gaining access with the default password.",PCI Program
  ,PCI 2.1.1,PCI 2.1.1 Wireless Vendor Defaults,"2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data, change ALL wireless vendor defaults at installation, including but not limited to default wireless encryption keys, passwords, and SNMP community strings.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.1.1.a Interview responsible personnel and examine supporting documentation to verify that:<br>• Encryption keys were changed from default at installation<br>• Encryption keys are changed anytime anyone with knowledge of the keys leaves the company or changes positions.<br><br>2.1.1.b Interview personnel and examine policies and procedures to verify:<br>• Default SNMP community strings are required to be changed upon installation.<br>• Default passwords/phrases on access points are required to be changed upon installation.<br><br>2.1.1.c Examine vendor documentation and login to wireless devices, with system administrator help, to verify:<br>• Default SNMP community strings are not used.<br>• Default passwords/passphrases on access points are not used.<br><br>2.1.1.d Examine vendor documentation and observe wireless configuration settings to verify firmware on wireless devices is updated to support strong encryption for:<br>• Authentication over wireless networks<br>• Transmission over wireless networks.<br><br>2.1.1.e Examine vendor documentation and observe wireless configuration settings to verify other security-related wireless vendor defaults were changed, if applicable.","If wireless networks are not implemented with sufficient security configurations (including changing default settings), wireless sniffers can eavesdrop on the traffic, easily capture data and passwords, and easily enter and attack the network.<br> In addition, the key-exchange protocol for older versions of 802.11x encryption (Wired Equivalent Privacy, or WEP) has been broken and can render the encryption useless. Firmware for devices should be updated to support more secure protocols.",PCI Program
  ,PCI 2.2,PCI 2.2 Configuration Standards,"2.2 Develop configuration standards for all system components. Assure that these standards address all known security vulnerabilities and are consistent with industry-accepted system hardening standards.<br>Sources of industry-accepted system hardening standards may include, but are not limited to:<br>• Center for Internet Security (CIS)<br>• International Organization for Standardization (ISO)<br>• SysAdmin Audit Network Security (SANS) Institute<br>• National Institute of Standards Technology (NIST).",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.2.a Examine the organization’s system configuration standards for all types of system components and verify the system configuration standards are consistent with industry- accepted hardening standards.<br><br>2.2.b Examine policies and interview personnel to verify that system configuration standards are updated as new vulnerability issues are identified, as defined in Requirement 6.1.<br><br>2.2.c Examine policies and interview personnel to verify that system configuration standards are applied when new systems are configured and verified as being in place before a system is installed on the network.<br><br>2.2.d Verify that system configuration standards include the following procedures for all types of system components:<br>• Changing of all vendor-supplied defaults and elimination of unnecessary default accounts<br>• Implementing only one primary function per server to prevent functions that require different security levels from co-existing on the same server<br>• Enabling only necessary services, protocols, daemons, etc., as required for the function of the system<br>• Implementing additional security features for any required services, protocols or daemons that are considered to be insecure<br>• Configuring system security parameters to prevent misuse<br>• Removing all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers.","There are known weaknesses with many operating systems, databases, and enterprise applications, and there are also known ways to configure these systems to fix security vulnerabilities. To help those that are not security experts, a number of security organizations have established system-hardening guidelines and recommendations, which advise how to correct these weaknesses.<br> Examples of sources for guidance on configuration standards include, but are not limited to: www.nist.gov, www.sans.org, and www.cisecurity.org, www.iso.org, and product vendors.<br> System configuration standards must be kept up to date to ensure that newly identified weaknesses are corrected prior to a system being installed on the network.",PCI Program
  ,PCI 2.2.1,PCI 2.2.1 One Primary Function Per Server,"2.2.1 Implement only one primary function per server to prevent functions that require different security levels from co-existing on the same server. (For example, web servers, database servers, and DNS should be implemented on separate servers.)
  Note: Where virtualization technologies are in use, implement only one primary function per virtual system component.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.2.1.a Select a sample of system components and inspect the system configurations to verify that only one primary function is implemented per server.<br><br>2.2.1.b If virtualization technologies are used, inspect the system configurations to verify that only one primary function is implemented per virtual system component or device.","If server functions that need different security levels are located on the same server, the security level of the functions with higher security needs would be reduced due to the presence of the lower-security functions. Additionally, the server functions with a lower security level may introduce security weaknesses to other functions on the same server.<br> By considering the security needs of different server functions as part of the system configuration standards and related processes, organizations can ensure that functions requiring different security levels don’t co-exist on the same server.",PCI Program
  ,PCI 2.2.2,PCI 2.2.2 Necessary Services,"2.2.2 Enable only necessary services, protocols, daemons, etc., as required for the function of the system.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.2.2.a Select a sample of system components and inspect enabled system services, daemons, and protocols to verify that only necessary services or protocols are enabled.<br><br>2.2.2.b Identify any enabled insecure services, daemons, or protocols and interview personnel to verify they are justified per documented configuration standards.","As stated in Requirement 1.1.6, there are many protocols that a business may need (or have enabled by default) that are commonly used by malicious individuals to compromise a network. Including this requirement as part of an organization's configuration standards and related processes ensures that only the necessary services and protocols are enabled.",PCI Program
  ,PCI 2.2.3,PCI 2.2.3 Additional Security Features,"2.2.3 Implement additional security features for any required services, protocols, or daemons that are considered to be insecure—for example, use secured technologies such as SSH, S-FTP, TLS, or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, FTP, etc.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.2.3.a Inspect configuration settings to verify that security features are documented and implemented for all insecure services, daemons, or protocols.<br><br>
  
  2.2.3.b For POS POI terminals (and the SSL/TLS termination points to which they connect) using SSL and/or early TLS and for which the entity asserts are not susceptible to any known exploits for those protocols:<br><br>
  