anchor.diff:  PCI 2.3
   PCI 2.4
   PCI 2.5
  -PCI 2.6",PCI Program,,,,,,,,,,,,,,
  -,,,,,,,,,,,,,,,,,,,,,,,,,,
  -Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,,
  -Assessment,Code*,Audit*,Title*,Description,Notes,Test Plan,Creator,Assignee,Effective Date,Stop Date,State,Primary Contact,Conclusion: Design,Conclusion: Operation,Secondary Contact,Assessment URL,Reference URL,,,,,,,,,
  -,CA.PCI 1.1,AUDIT-PCI,PCI 1.1 Firewall and Router Configuration assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 1.2,AUDIT-PCI,PCI 1.2 Firewall and Router Connections Configuration assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,,
  -,CA.PCI 1.2.1,AUDIT-PCI,PCI 1.2.1 Traffic Restrictions assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Not Applicable,Not Applicable,,,,,,,,,,,,
  -,CA.PCI 1.2.2,AUDIT-PCI,PCI 1.2.2 Secure and Synchronize assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,,
  -,CA.PCI 1.2.3,AUDIT-PCI,PCI 1.2.3 Perimeter Firewalls assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 1.3,AUDIT-PCI,PCI 1.3 Examine Router and Firewall Configurations assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 1.3.1,AUDIT-PCI,PCI 1.3.1 DMZ to Limit Inbound Traffic assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 1.3.2,AUDIT-PCI,PCI 1.3.2 DMZ Limiting IP Addresses assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 1.3.3,AUDIT-PCI,PCI 1.3.3 Direct Connections Prohibited assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 1.3.4,AUDIT-PCI,PCI 1.3.4 Anti-Spoofing assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,,
  -,CA.PCI 1.3.5,AUDIT-PCI,PCI 1.3.5 Outbound Traffic Authorized assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 1.3.6,AUDIT-PCI,PCI 1.3.6 Stateful Inspection assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 1.3.7,AUDIT-PCI,PCI 1.3.7 Internal Network Zone assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 1.3.8,AUDIT-PCI,PCI 1.3.8 Do Not Disclose to Unauthorized Parties assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,,
  -,CA.PCI 1.4,AUDIT-PCI,PCI 1.4 Personal Firewall Software assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,,
  -,CA.PCI 1.5,AUDIT-PCI,PCI 1.5 Managing Firewalls assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,,
  -,CA.PCI 2.1,AUDIT-PCI,PCI 2.1 Change Vendor-Supplied Defaults assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,,
  -,CA.PCI 2.1.1,AUDIT-PCI,PCI 2.1.1 Wireless Vendor Defaults assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,,
  -,CA.PCI 2.2,AUDIT-PCI,PCI 2.2 Configuration Standards assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,,
  -,CA.PCI 2.2.1,AUDIT-PCI,PCI 2.2.1 One Primary Function Per Server assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 2.2.2,AUDIT-PCI,PCI 2.2.2 Necessary Services assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 2.2.3,AUDIT-PCI,PCI 2.2.3 Additional Security Features assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 2.2.4,AUDIT-PCI,PCI 2.2.4 System Security Perimeters assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Not Applicable,Not Applicable,,,,,,,,,,,,
  -,CA.PCI 2.2.5,AUDIT-PCI,PCI 2.2.5 Remove Unnecessary Functionality assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,,
  -,CA.PCI 2.3,AUDIT-PCI,PCI 2.3 Encryption assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 2.4,AUDIT-PCI,PCI 2.4 Inventory of System Components assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 2.5,AUDIT-PCI,PCI 2.5 Examine Documentation and Interview Personnel assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,,
  -,CA.PCI 2.6,AUDIT-PCI,PCI 2.6 Testing Procedures assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,,
  -,,,,,,,,,,,,,,,,,,,,,,,,,,
  -Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,,
  -System,Code*,Title*,Description,Notes,Owner*,Effective Date,Stop Date,State,Primary Contact,Network Zone,Secondary Contact,System URL,Reference URL,map:program,,,,,,,,,,,,
  -,SYSTEM-1,Application Delivery System,Automated system for classifying incoming applications and initial data-base entry for candidates,Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-3,Web Application,,Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-4,Salesforce CRM,,Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-5,Workday Financial Management,,Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-6,Authorization Roles and Permissions,"<b>Authorization </b>(also spelt <b>Authorisation</b>) is the function of specifying access rights to resources, which is related to <a href=""http://en.wikipedia.org/wiki/Information_security"" title=""Link: http://en.wikipedia.org/wiki/Information_security"">information security</a> and <a href=""http://en.wikipedia.org/wiki/Computer_security"" title=""Link: http://en.wikipedia.org/wiki/Computer_security"">computer security</a> in general and to <a href=""http://en.wikipedia.org/wiki/Access_control"" title=""Link: http://en.wikipedia.org/wiki/Access_control"">access control</a> in particular. More formally, ""to authorize"" is to define access policy. For example, <a href=""http://en.wikipedia.org/wiki/Human_resources"" title=""Link: http://en.wikipedia.org/wiki/Human_resources"">human resources</a> staff are normally authorized to access employee records, and this policy is usually formalized as access control rules in a computer system. During operation, the system uses the access control rules to decide whether access requests from (<a href=""http://en.wikipedia.org/wiki/Authentication"">authenticated</a>) consumers shall be approved (granted) or disapproved (rejected). Resources include individual files' or items' <a href=""http://en.wikipedia.org/wiki/Data"" title=""Link: http://en.wikipedia.org/wiki/Data"">data</a>, <a href=""http://en.wikipedia.org/wiki/Computer_program"" title=""Link: http://en.wikipedia.org/wiki/Computer_program"">computer programs</a>, computer <a href=""http://en.wikipedia.org/wiki/Computer_hardware"" title=""Link: http://en.wikipedia.org/wiki/Computer_hardware"">devices</a> and functionality provided by <a href=""http://en.wikipedia.org/wiki/Computer_application"" title=""Link: http://en.wikipedia.org/wiki/Computer_application"">computer applications</a>.",Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-7,ACLS,"<p>An <b>access control list</b> (<b>ACL</b>), with respect to a computer file system, is a list of <a href=""http://en.wikipedia.org/wiki/File_system_permissions"">permissions</a> attached to an <a href=""http://en.wikipedia.org/wiki/Computer_file"">object</a>. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.<a href=""http://en.wikipedia.org/wiki/Access_control_list#cite_note-1"">[1]</a> Each entry in a typical ACL specifies a subject and an operation. For instance, if a file has an ACL that contains (Alice, delete), this would give Alice permission to delete the file.</p><div><br></div><p></p><div></div>",Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,http://en.wikipedia.org/wiki/Access_control_list,PCI Program,,,,,,,,,,,,
  -,SYSTEM-8,HIRE,,Example System,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-9,Asset Repository Management System,"Asset management is a systematic process of operating, maintaining, upgrading, and disposing of assets cost-effectively. Organizations need to identify all assets and create and maintain security controls around them.",Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-10,GitHub,"All Reciprocity code is hosted on <a href=""https://github.com"">github.com</a>",,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,https://github.com/reciprocity,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-11,ARTY,"Automated front end testing framework, relying on Selenium/WebDriver and run as a Jenkins process",,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,http://ci.reciprocitylabs.com:8080/,https://github.com/dtzinov/ggrc-test,PCI Program,,,,,,,,,,,,
  -,SYSTEM-12,Jumpcloud,"<img alt="""" src=""https://console.jumpcloud.com/img/jump-cloud-logo.png""><br>Server Management from the Cloud<br><br><div><h2>JUMPCLOUD AUTOMATES SERVER MANAGEMENT</h2><div><div></div></div></div><div><h2></h2><h5><a href=""http://www.jumpcloud.com/simple-powerful-user-management/"">User management</a></h5><h5><ul><li>Manage Admin/SSH user access  add, change, terminate</li><li>Manage SSH keys and multi-factor authentication</li><li>Centralized logging and audit history</li><li>Web-based password reset</li><li>Fully-elastic: auto-provision user accounts when scaling up or down</li><li>Linux and Windows support</li></ul></h5><h5><a href=""http://www.jumpcloud.com/patch-management/"">Patch management</a></h5><h5><ul><li>Track needed patches across your entire organization</li><li>Ensure patches are up-to-date</li><li>Zero-in on the most critical patch requirements</li><li>Prioritize network-listening services (the first vector of attack)</li></ul></h5><h5>Dynamic configuration management</h5><h5><ul><li>Manage dynamic configurations such as root logins, SSH keys, etc.</li><li>RESTful JSON-based API</li></ul></h5><h5><a href=""http://www.jumpcloud.com/easy-attack-monitoring/"">Security management</a></h5><h5><ul><li>Detecting compromises from brute force attacks</li><li>Monitor admin activity  assess and alert on suspicious sudo commands</li><li>Monitor suspicious login activity  easily identify anomalous logins</li></ul></h5><h5>Compliance management</h5><h5><ul><li>Enforce PCI Section 8  user access and authentication</li></ul></h5></div>",<h2><br></h2>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,https://www.jumpcloud.com/signup/,http://www.jumpcloud.com/features/,PCI Program,,,,,,,,,,,,
  -,SYSTEM-13,FIN-SS26,FIN-SS26  Unix Sun   192.169.1.1,VM,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-14,Human resource management system (HRMS),,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-15,Physical access control system,,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-16,FINSS-30,IP=191.126.1.2,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-17,Unix-Vm-Fin-ss27,IP=192.168.1.1,Unix box used for apache and tomcat web server,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-18,Unix-Vm-Fin-ss28,IP=192.168.1.2,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-19,Cisco ASA Firewall,Cisco ASA 5520<br>Serial#: <br>Inside Interface:  <br>DMZ Interface:  <br>Outside Interface:  <br>Comment: Cisco Perimeter Firewall,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-20,Dell R-710 Server,"Hostname: <br>Private IP Address: <br>Public IP Address: <br>Operating System:<br>System Purpose: Web Services, Database etc.<br>Serial Number: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br><br><br>",,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-21,IDS / IPS Devices,Hostname: <br>Private IP Address: <br>Public IP Address: <br>Serial Number: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br>,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-22,VMWare Host System,Hostname: <br>Private IP Address: <br>Public IP Address: <br>VLAN Data: <br>Number of Guests: <br>Operating System: <br>Management Console URL: <br>Serial Number: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br>,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-23,Router Devices,Hostname: <br>Private IP Address: <br>Public IP Address: <br>Operating System: <br>Security Zone:<br>Serial Number: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br>,"More Entries should be added for Network Zone:<br>QA, Development, CDE, etc.",albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-24,Network Switching Devices,Hostname: <br>Private IP Address: <br>Public IP Address: <br>Serial Number: <br>Operating System: <br>VLAN's Supported: <br>Routing Protocols: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br>,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-25,VMWare Guest System,Hostname: <br><span>Private IP Address: </span><br><span>Public IP Address: </span><br><span>VLAN Data: </span><br><span>Number of Guests: </span><br><span>Operating System: </span><br><span>Serial Number: </span><br><span>Enter Zone: </span><br><span>Physical Location: </span><br><span>Department: </span><br><span>Enter Asset Tag: </span><br><span>Comments: </span><br>,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-199,HCM Workday,,,bthies@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-200,SAP,,,bthies@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-201,PeopleSoft,,,bthies@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,SYSTEM-202,Hyperion,,,bthies@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,,
  -,,,,,,,,,,,,,,,,,,,,,,,,,,
  -Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,,
  -Audit,Code*,Program,Title*,Description,Planned Start Date,Planned End Date,Planned Report Period from,Planned Report Period to,Status*,Internal Audit Lead*,Auditors,,,,,,,,,,,,,,,
  -,AUDIT-SOC,SOC2/3,2014: SOC 2/3 - Audit 1,,,,,,Planned,bthies@reciprocitylabs.com,,,,,,,,,,,,,,,,
  -,AUDIT-Consolidated,Consolidated,SOC program,,,,,,Planned,bthies@reciprocitylabs.com,,,,,,,,,,,,,,,,
  -,AUDIT-PCI,PCI Program,PCI Audit,,,,,,Planned,bthies@reciprocitylabs.com,,,,,,,,,,,,,,,,
  -,,,,,,,,,,,,,,,,,,,,,,,,,,
  -Object type,,,,,,,,,,,,,,,,,,,,,,,,,,
  -Person,Name,Email*,Company,Role,,,,,,,,,,,,,,,,,,,,,,
  -,Anze,anze@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Albert,albert@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Brad Thies,bthies@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Miha Zidar,miha@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Rob,rob@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Ken,ken@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Jamila,jamila@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Brad Thies,bthies@barradvisory.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Urban,urban@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Amy Peterson,amy@reciprocitylabs.com,"Reciprocity, Inc.",Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Predrag,predrag@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Jost,jost@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Danny,danny@reciprocitylabs.com,Reciprocity,Administrator,,,,,,,,,,,,,,,,,,,,,,
  -,Jeff,jeff.tchang@gmail.com,,Administrator,,,,,,,,,,,,,,,,,,,,,,
  +PCI 2.6",PCI Program,,,,,,,,,,,,,
  +,,,,,,,,,,,,,,,,,,,,,,,,,
  +Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,
  +Assessment,Code*,Audit*,Title*,Description,Notes,Test Plan,Creator,Assignee,Effective Date,Stop Date,State,Primary Contact,Conclusion: Design,Conclusion: Operation,Secondary Contact,Assessment URL,Reference URL,,,,,,,,
  +,CA.PCI 1.1,AUDIT-PCI,PCI 1.1 Firewall and Router Configuration assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 1.2,AUDIT-PCI,PCI 1.2 Firewall and Router Connections Configuration assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,
  +,CA.PCI 1.2.1,AUDIT-PCI,PCI 1.2.1 Traffic Restrictions assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Not Applicable,Not Applicable,,,,,,,,,,,
  +,CA.PCI 1.2.2,AUDIT-PCI,PCI 1.2.2 Secure and Synchronize assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,
  +,CA.PCI 1.2.3,AUDIT-PCI,PCI 1.2.3 Perimeter Firewalls assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 1.3,AUDIT-PCI,PCI 1.3 Examine Router and Firewall Configurations assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 1.3.1,AUDIT-PCI,PCI 1.3.1 DMZ to Limit Inbound Traffic assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 1.3.2,AUDIT-PCI,PCI 1.3.2 DMZ Limiting IP Addresses assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 1.3.3,AUDIT-PCI,PCI 1.3.3 Direct Connections Prohibited assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 1.3.4,AUDIT-PCI,PCI 1.3.4 Anti-Spoofing assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,
  +,CA.PCI 1.3.5,AUDIT-PCI,PCI 1.3.5 Outbound Traffic Authorized assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 1.3.6,AUDIT-PCI,PCI 1.3.6 Stateful Inspection assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 1.3.7,AUDIT-PCI,PCI 1.3.7 Internal Network Zone assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 1.3.8,AUDIT-PCI,PCI 1.3.8 Do Not Disclose to Unauthorized Parties assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,
  +,CA.PCI 1.4,AUDIT-PCI,PCI 1.4 Personal Firewall Software assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,
  +,CA.PCI 1.5,AUDIT-PCI,PCI 1.5 Managing Firewalls assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,
  +,CA.PCI 2.1,AUDIT-PCI,PCI 2.1 Change Vendor-Supplied Defaults assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,
  +,CA.PCI 2.1.1,AUDIT-PCI,PCI 2.1.1 Wireless Vendor Defaults assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,
  +,CA.PCI 2.2,AUDIT-PCI,PCI 2.2 Configuration Standards assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,
  +,CA.PCI 2.2.1,AUDIT-PCI,PCI 2.2.1 One Primary Function Per Server assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 2.2.2,AUDIT-PCI,PCI 2.2.2 Necessary Services assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 2.2.3,AUDIT-PCI,PCI 2.2.3 Additional Security Features assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 2.2.4,AUDIT-PCI,PCI 2.2.4 System Security Perimeters assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Not Applicable,Not Applicable,,,,,,,,,,,
  +,CA.PCI 2.2.5,AUDIT-PCI,PCI 2.2.5 Remove Unnecessary Functionality assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Needs improvement,Needs improvement,,,,,,,,,,,
  +,CA.PCI 2.3,AUDIT-PCI,PCI 2.3 Encryption assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 2.4,AUDIT-PCI,PCI 2.4 Inventory of System Components assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 2.5,AUDIT-PCI,PCI 2.5 Examine Documentation and Interview Personnel assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,Effective,Effective,,,,,,,,,,,
  +,CA.PCI 2.6,AUDIT-PCI,PCI 2.6 Testing Procedures assessment for 2015: PCI-DSS 3.0 Security Program (Reference Program) - Audit 1 1,,,,danny@reciprocitylabs.com,danny@reciprocitylabs.com,,,Not Started,danny@reciprocitylabs.com,,,,,,,,,,,,,
  +,,,,,,,,,,,,,,,,,,,,,,,,,
  +Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,
  +System,Code*,Title*,Description,Notes,Owner*,Effective Date,Stop Date,State,Primary Contact,Network Zone,Secondary Contact,System URL,Reference URL,map:program,,,,,,,,,,,
  +,SYSTEM-1,Application Delivery System,Automated system for classifying incoming applications and initial data-base entry for candidates,Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-3,Web Application,,Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-4,Salesforce CRM,,Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-5,Workday Financial Management,,Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-6,Authorization Roles and Permissions,"<b>Authorization </b>(also spelt <b>Authorisation</b>) is the function of specifying access rights to resources, which is related to <a href=""http://en.wikipedia.org/wiki/Information_security"" title=""Link: http://en.wikipedia.org/wiki/Information_security"">information security</a> and <a href=""http://en.wikipedia.org/wiki/Computer_security"" title=""Link: http://en.wikipedia.org/wiki/Computer_security"">computer security</a> in general and to <a href=""http://en.wikipedia.org/wiki/Access_control"" title=""Link: http://en.wikipedia.org/wiki/Access_control"">access control</a> in particular. More formally, ""to authorize"" is to define access policy. For example, <a href=""http://en.wikipedia.org/wiki/Human_resources"" title=""Link: http://en.wikipedia.org/wiki/Human_resources"">human resources</a> staff are normally authorized to access employee records, and this policy is usually formalized as access control rules in a computer system. During operation, the system uses the access control rules to decide whether access requests from (<a href=""http://en.wikipedia.org/wiki/Authentication"">authenticated</a>) consumers shall be approved (granted) or disapproved (rejected). Resources include individual files' or items' <a href=""http://en.wikipedia.org/wiki/Data"" title=""Link: http://en.wikipedia.org/wiki/Data"">data</a>, <a href=""http://en.wikipedia.org/wiki/Computer_program"" title=""Link: http://en.wikipedia.org/wiki/Computer_program"">computer programs</a>, computer <a href=""http://en.wikipedia.org/wiki/Computer_hardware"" title=""Link: http://en.wikipedia.org/wiki/Computer_hardware"">devices</a> and functionality provided by <a href=""http://en.wikipedia.org/wiki/Computer_application"" title=""Link: http://en.wikipedia.org/wiki/Computer_application"">computer applications</a>.",Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-7,ACLS,"<p>An <b>access control list</b> (<b>ACL</b>), with respect to a computer file system, is a list of <a href=""http://en.wikipedia.org/wiki/File_system_permissions"">permissions</a> attached to an <a href=""http://en.wikipedia.org/wiki/Computer_file"">object</a>. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.<a href=""http://en.wikipedia.org/wiki/Access_control_list#cite_note-1"">[1]</a> Each entry in a typical ACL specifies a subject and an operation. For instance, if a file has an ACL that contains (Alice, delete), this would give Alice permission to delete the file.</p><div><br></div><p></p><div></div>",Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,http://en.wikipedia.org/wiki/Access_control_list,PCI Program,,,,,,,,,,,
  +,SYSTEM-8,HIRE,,Example System,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-9,Asset Repository Management System,"Asset management is a systematic process of operating, maintaining, upgrading, and disposing of assets cost-effectively. Organizations need to identify all assets and create and maintain security controls around them.",Example System<br>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-10,GitHub,"All Reciprocity code is hosted on <a href=""https://github.com"">github.com</a>",,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,https://github.com/reciprocity,,PCI Program,,,,,,,,,,,
  +,SYSTEM-11,ARTY,"Automated front end testing framework, relying on Selenium/WebDriver and run as a Jenkins process",,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,http://ci.reciprocitylabs.com:8080/,https://github.com/dtzinov/ggrc-test,PCI Program,,,,,,,,,,,
  +,SYSTEM-12,Jumpcloud,"<img alt="""" src=""https://console.jumpcloud.com/img/jump-cloud-logo.png""><br>Server Management from the Cloud<br><br><div><h2>JUMPCLOUD AUTOMATES SERVER MANAGEMENT</h2><div><div></div></div></div><div><h2></h2><h5><a href=""http://www.jumpcloud.com/simple-powerful-user-management/"">User management</a></h5><h5><ul><li>Manage Admin/SSH user access  add, change, terminate</li><li>Manage SSH keys and multi-factor authentication</li><li>Centralized logging and audit history</li><li>Web-based password reset</li><li>Fully-elastic: auto-provision user accounts when scaling up or down</li><li>Linux and Windows support</li></ul></h5><h5><a href=""http://www.jumpcloud.com/patch-management/"">Patch management</a></h5><h5><ul><li>Track needed patches across your entire organization</li><li>Ensure patches are up-to-date</li><li>Zero-in on the most critical patch requirements</li><li>Prioritize network-listening services (the first vector of attack)</li></ul></h5><h5>Dynamic configuration management</h5><h5><ul><li>Manage dynamic configurations such as root logins, SSH keys, etc.</li><li>RESTful JSON-based API</li></ul></h5><h5><a href=""http://www.jumpcloud.com/easy-attack-monitoring/"">Security management</a></h5><h5><ul><li>Detecting compromises from brute force attacks</li><li>Monitor admin activity  assess and alert on suspicious sudo commands</li><li>Monitor suspicious login activity  easily identify anomalous logins</li></ul></h5><h5>Compliance management</h5><h5><ul><li>Enforce PCI Section 8  user access and authentication</li></ul></h5></div>",<h2><br></h2>,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,https://www.jumpcloud.com/signup/,http://www.jumpcloud.com/features/,PCI Program,,,,,,,,,,,
  +,SYSTEM-13,FIN-SS26,FIN-SS26  Unix Sun   192.169.1.1,VM,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-14,Human resource management system (HRMS),,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-15,Physical access control system,,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-16,FINSS-30,IP=191.126.1.2,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-17,Unix-Vm-Fin-ss27,IP=192.168.1.1,Unix box used for apache and tomcat web server,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-18,Unix-Vm-Fin-ss28,IP=192.168.1.2,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-19,Cisco ASA Firewall,Cisco ASA 5520<br>Serial#: <br>Inside Interface:  <br>DMZ Interface:  <br>Outside Interface:  <br>Comment: Cisco Perimeter Firewall,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-20,Dell R-710 Server,"Hostname: <br>Private IP Address: <br>Public IP Address: <br>Operating System:<br>System Purpose: Web Services, Database etc.<br>Serial Number: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br><br><br>",,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-21,IDS / IPS Devices,Hostname: <br>Private IP Address: <br>Public IP Address: <br>Serial Number: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br>,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-22,VMWare Host System,Hostname: <br>Private IP Address: <br>Public IP Address: <br>VLAN Data: <br>Number of Guests: <br>Operating System: <br>Management Console URL: <br>Serial Number: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br>,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-23,Router Devices,Hostname: <br>Private IP Address: <br>Public IP Address: <br>Operating System: <br>Security Zone:<br>Serial Number: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br>,"More Entries should be added for Network Zone:<br>QA, Development, CDE, etc.",albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-24,Network Switching Devices,Hostname: <br>Private IP Address: <br>Public IP Address: <br>Serial Number: <br>Operating System: <br>VLAN's Supported: <br>Routing Protocols: <br>Enter Zone: <br>Physical Location: <br>Department: <br>Enter Asset Tag: <br>Comments: <br>,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-25,VMWare Guest System,Hostname: <br><span>Private IP Address: </span><br><span>Public IP Address: </span><br><span>VLAN Data: </span><br><span>Number of Guests: </span><br><span>Operating System: </span><br><span>Serial Number: </span><br><span>Enter Zone: </span><br><span>Physical Location: </span><br><span>Department: </span><br><span>Enter Asset Tag: </span><br><span>Comments: </span><br>,,albert@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-199,HCM Workday,,,bthies@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-200,SAP,,,bthies@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-201,PeopleSoft,,,bthies@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,SYSTEM-202,Hyperion,,,bthies@reciprocitylabs.com,,,Draft,albert@reciprocitylabs.com,,,,,PCI Program,,,,,,,,,,,
  +,,,,,,,,,,,,,,,,,,,,,,,,,
  +Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,
  +Audit,Code*,Program,Title*,Description,Planned Start Date,Planned End Date,Planned Report Period from,Planned Report Period to,Status*,Internal Audit Lead*,Auditors,,,,,,,,,,,,,,
  +,AUDIT-SOC,SOC2/3,2014: SOC 2/3 - Audit 1,,,,,,Planned,bthies@reciprocitylabs.com,,,,,,,,,,,,,,,
  +,AUDIT-Consolidated,Consolidated,SOC program,,,,,,Planned,bthies@reciprocitylabs.com,,,,,,,,,,,,,,,
  +,AUDIT-PCI,PCI Program,PCI Audit,,,,,,Planned,bthies@reciprocitylabs.com,,,,,,,,,,,,,,,
  +,,,,,,,,,,,,,,,,,,,,,,,,,
  +Object type,,,,,,,,,,,,,,,,,,,,,,,,,
  +Person,Name,Email*,Company,Role,,,,,,,,,,,,,,,,,,,,,
  +,Anze,anze@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Albert,albert@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Brad Thies,bthies@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Miha Zidar,miha@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Rob,rob@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Ken,ken@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Jamila,jamila@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Brad Thies,bthies@barradvisory.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Urban,urban@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Amy Peterson,amy@reciprocitylabs.com,"Reciprocity, Inc.",Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Predrag,predrag@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Jost,jost@reciprocitylabs.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Danny,danny@reciprocitylabs.com,Reciprocity,Administrator,,,,,,,,,,,,,,,,,,,,,
  +,Jeff,jeff.tchang@gmail.com,,Administrator,,,,,,,,,,,,,,,,,,,,,
  
positive.code: Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,,
  Program,Code*,Title*,Description,Notes,Manager*,Editor,Reader,Effective Date,Stop Date,State,Primary Contact,,,Secondary Contact,Program URL,Reference URL,,,,,,,,,,
  ,PCI Program,PCI-DSS 3.1 Security Program (Reference Program),"
  The PCI Data Security Standard specifies 12 requirements for compliance, organized into six logically related groups called ""control objectives.""  Each version of PCI DSS has divided these 12 requirements into a number of sub-requirements differently, but the 12 high level requirements have not changed since the inception of the standard.
  
  
negative.code: - Risk-assessment results and risk-reduction controls in place;<br>
  - Description of processes to monitor for new vulnerabilities associated with SSL/early TLS;<br>
  - Description of change control processes that are implemented to ensure SSL/early TLS is not implemented into new environments;<br>
  - Overview of migration project plan including target migration completion date no later than June 30, 2016.","Enabling security features before new servers are deployed will prevent servers being installed into the environment with insecure configurations.<br> Ensuring that all insecure services, protocols, and daemons are adequately secured with appropriate security features makes it more difficult for malicious individuals to take advantage of commonly used points of compromise within a network.<br> Refer to industry standards and best practices for information on strong cryptography and secure protocols (e.g., NIST SP 800-52 and SP 800-57, OWASP, etc.).<br><br> Regarding use of SSL/early TLS: Entities using SSL and early TLS must work towards upgrading to a strong cryptographic protocol as soon as possible. Additionally, SSL and/or early TLS must not be introduced into environments where they don’t already exist. At the time of publication, the known vulnerabilities are difficult to exploit in POS POI payment environments. However, new vulnerabilities could emerge at any time, and it is up to the organization to remain up-to-date with vulnerability trends and determine whether or not they are susceptible to any known exploits.<br> Refer to the PCI SSC Information Supplement Migrating from SSL and Early TLS for further guidance on the use of SSL/early TLS.",PCI Program
  ,PCI 2.2.4,PCI 2.2.4 System Security Perimeters,2.2.4 Configure system security parameters to prevent misuse.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,2.2.4.a Interview system administrators and/or security managers to verify that they have knowledge of common security parameter settings for system components.<br><br>2.2.4.b Examine the system configuration standards to verify that common security parameter settings are included.<br><br>2.2.4.c Select a sample of system components and inspect the common security parameters to verify that they are set appropriately and in accordance with the configuration standards.,"System configuration standards and related processes should specifically address security settings and parameters that have known security implications for each type of system in use.<br> In order for systems to be configured securely, personnel responsible for configuration and/or administering systems must be knowledgeable in the specific security parameters and settings that apply to the system.",PCI Program
  ,PCI 2.2.5,PCI 2.2.5 Remove Unnecessary Functionality,"2.2.5 Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.2.5.a Select a sample of system components and inspect the configurations to verify that all unnecessary functionality (for example, scripts, drivers, features, subsystems, file systems, etc.) is removed.<br><br>2.2.5.b. Examine the documentation and security parameters to verify enabled functions are documented and support secure configuration.<br><br>2.2.5.c. Examine the documentation and security parameters to verify that only documented functionality is present on the sampled system components.","Unnecessary functions can provide additional opportunities for malicious individuals to gain access to a system. By removing unnecessary functionality, organizations can focus on securing the functions that are required and reduce the risk that unknown functions will be exploited.<br> Including this in server-hardening standards and processes addresses the specific security implications associated with unnecessary functions (for example, by removing/disabling FTP or the web server if the server will not be performing those functions).",PCI Program
  ,PCI 2.3,PCI 2.3 Encryption,"2.3 Encrypt all non-console administrative access using strong cryptography. Use technologies such as SSH, VPN, or TLS for web-based management and other non-console administrative access.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.3 Select a sample of system components and verify that non-console administrative access is encrypted by performing the following:<br><br>
  
  2.3.a Observe an administrator log on to each system and examine system configurations to verify that a strong encryption method is invoked before the administrator’s password is requested.<br><br>
  ￼￼￼
  2.3.b Review services and parameter files on systems to determine that Telnet and other insecure remote-login commands are not available for non-console access.","If non-console (including remote) administration does not use secure authentication and encrypted communications, sensitive administrative or operational level information (like administrator’s IDs and passwords) can be revealed to an eavesdropper. A malicious individual could use this information to access the network, become administrator, and steal data.<br> Clear-text protocols (such as HTTP, telnet, etc.) do not encrypt traffic or logon details, making it easy for an eavesdropper to intercept this information.<br> To be considered “strong cryptography,” industryrecognized protocols with appropriate key strengths and key management should be in place as applicable for the type of technology in use. (Refer to ""strong cryptography” in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms, and industry standards and best practices such as NIST SP 800-52 and SP 800-57, OWASP, etc.)<br> Regarding use of SSL/early TLS: Entities using SSL and early TLS must work towards upgrading to a strong cryptographic protocol as soon as possible. Additionally, SSL and/or early TLS must not be introduced into environments where they don’t already exist. At the time of publication, the known vulnerabilities are difficult to exploit in POS POI payment environments. However, new vulnerabilities could emerge at any time, and it is up to the organization to remain up-to-date with vulnerability trends and determine whether or not they are susceptible to any known exploits.<br> Refer to the PCI SSC Information Supplement Migrating from SSL and Early TLS for further guidance on the use of SSL/early TLS.",PCI Program
  ,PCI 2.4,PCI 2.4 Inventory of System Components,2.4 Maintain an inventory of system components that are in scope for PCI DSS.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,2.4.a Examine system inventory to verify that a list of hardware and software components is maintained and includes a description of function/use for each.<br><br>2.4.b Interview personnel to verify the documented inventory is kept current.,"Maintaining a current list of all system components will enable an organization to accurately and efficiently define the scope of their environment for implementing PCI DSS controls. Without an inventory, some system components could be forgotten, and be inadvertently excluded from the organization’s configuration standards.",PCI Program
  ,PCI 2.5,PCI 2.5 Examine Documentation and Interview Personnel,"2.5 Ensure that security policies and operational procedures for managing vendor defaults and other security parameters are documented, in use, and known to all affected parties.",,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.5 Examine documentation and interview personnel to verify that security policies and operational procedures for managing vendor defaults and other security parameters are:<br><br>·    Documented,<br>·    In use, and<br>·    Known to all affected parties.",Personnel need to be aware of and following security policies and daily operational procedures to ensure vendor defaults and other security parameters are continuously managed to prevent insecure configurations.,PCI Program
  ,PCI 2.6,PCI 2.6 Testing Procedures,2.6 Shared hosting providers must protect each entity’s hosted environment and cardholder data. These providers must meet specific requirements as detailed in Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers.,,,albert@reciprocitylabs.com,,,Draft,,,,,,,,,,,,,,"2.6 Perform testing procedures A.1.1 through A.1.4 detailed in Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers for PCI DSS assessments of shared hosting providers, to verify that shared hosting providers protect their entities’ (merchants and service providers) hosted environment and data.","This is intended for hosting providers that provide shared hosting environments for multiple clients on the same server. When all data is on the same server and under control of a single environment, often the settings on these shared servers are not manageable by individual clients. This allows clients to add insecure functions and scripts that impact the security of all other client environments; and thereby make it easy for a malicious individual to compromise one client's data and thereby gain access to all other clients' data. See Appendix A for details of requirements.",PCI Program
  ,,,,,,,,,,,,,,,,,,,,,,,,,
  Object type,"Must be unique. Can be left empty for autogeneration. If updating or deleting, code is required",,,,,,,,,,,,,,,,,,,,,,,,
  Objective,Code*,Title*,Description,Notes,Owner*,State,Primary Contact,Secondary Contact,Objective URL,Reference URL,map:control,map:program,,,,,,,,,,,,,
  ,01_PCI,PCI Requirement 1 - Firewall Configuration,Install and maintain a firewall configuration to protect cardholder data,,albert@reciprocitylabs.com,Draft,,,,,"PCI 1.1
  PCI 1.2
  PCI 1.2.1
  