Tuna PCI DSS Compliance Related Policies and Procedures#
[Install and Maintain Network Security Controls]
[1.1 Processes and mechanisms for installing and maintaining network security controls are defined and understood]
- Configuration and Change Management
- [Configuration and Management of Network Controls]
- Threat Detection and Prevention
- [Firewall Protection]
- Configuration and Change Management
[1.2 Network security controls (NSCs) are configured and maintained]
- Access
- [Service Accounts]
- Threat Detection and Prevention
- [Firewall Protection]
- Access
[1.3 Network access to and from the cardholder data environment is restricted]
- Security Architecture and Operating Model
- [Security Principles]
- HR and Personnel Security
- [Acceptable Use of End-user Computing]
- Access
- [Employee Workstation / Endpoints Usage]
- Data Protection
- [Protecting Data In Transit]
- Security Architecture and Operating Model
[1.4 Network connections between trusted and untrusted networks are controlled]
- HR and Personnel Security
- [Acceptable Use of End-user Computing]
- Access
- [Employee Workstation / Endpoints Usage]
- Secure Software Development and Product Security
- [Outsourced Software Development]
- HR and Personnel Security
[1.5 Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated]
- Security Architecture and Operating Model
- [Security Principles]
- HR and Personnel Security
- [Acceptable Use of End-user Computing]
- Access
- [Employee Workstation / Endpoints Usage]
- Configuration and Change Management
- [Configuration Management Processes]
- Security Architecture and Operating Model
[Apply Secure Configurations to All System Components]
[2.1 Processes and mechanisms for applying secure configurations to all system components are defined and understood]
- Configuration and Change Management
- [Configuration and Management of Network Controls]
- [Production Systems Provisioning]
- [Server Hardening Guidelines and Processes]
- Configuration and Change Management
[2.2 System components are configured and managed securely]
- Risk Management and Risk Assessment Process
- [Risk Assessment and Analysis]
- Configuration and Change Management
- [Configuration Management Processes]
- [User Endpoint Security Controls and Configuration]
- [Server Hardening Guidelines and Processes]
- Risk Management and Risk Assessment Process
[2.3 Wireless environments are configured and managed securely]
- Security Architecture and Operating Model
- [Security Principles]
- Data Management
- [Data Protection Implementation]
- Security Architecture and Operating Model
[Protect Stored Account Data]
[3.1 Processes and mechanisms for protecting stored account data are defined and understood]
- Data Protection
- [Data Protection Policy]
- [Data Security Standards]
- Data Protection
[3.2 Storage of account data is kept to a minimum]
- Data Management
- [Data Retention]
- [Data Minimization]
- Data Management
[3.3 Sensitive authentication data (SAD) is not stored after authorization]
- Data Protection
- [Data Protection Implementation]
- [Data Storage Controls]
- Data Protection
[3.4 Access to displays of full PAN and ability to copy cardholder data are restricted]
- Data Protection
- [Data Access Controls]
- [Display Masking]
- Data Protection
[3.5 Primary account number (PAN) is secured wherever it is stored]
- Data Protection
- [Encryption Key Management]
- [Secure Storage]
- Data Protection
[3.6 Cryptographic keys used to protect stored account data are secured]
- Data Protection
- [Key Management]
- [Cryptographic Controls]
- Data Protection
[3.7 Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented]
- Data Protection
- [Key Lifecycle Management]
- [Cryptographic Procedures]
- Data Protection
[Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks]
[4.1 Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks are defined and documented]
- Data Protection
- [Protecting Data In Transit]
- Secure Software Development and Product Security
- [High Level Application Security Requirements]
- Data Protection
[4.2 PAN is protected with strong cryptography during transmission]
- Data Protection
- [Data Protection Implementation and Processes]
- HR and Personnel Security
- [Acceptable Use of End-user Computing]
- Data Protection
[Protect All Systems and Networks from Malicious Software]
[5.1 Processes and mechanisms for protecting all systems and networks from malicious software are defined and understood]
- Threat Detection and Prevention
- [Anti-Malware Implementation]
- [System Protection]
- Threat Detection and Prevention
[5.2 Malicious software (malware) is prevented, or detected and addressed]
- Configuration and Change Management
- [System Updates and Patches]
- [Security Monitoring]
- Configuration and Change Management
[5.3 Anti-malware mechanisms and processes are active, maintained, and monitored]
- Configuration and Change Management
- [Configuration Management]
- [Change Control]
- Configuration and Change Management
[5.4 Anti-phishing mechanisms protect users against phishing attacks]
- HR and Personnel Security
- [Security Awareness]
- [Phishing Protection]
- HR and Personnel Security
[Develop and Maintain Secure Systems and Software]
[6.1 Processes and mechanisms for developing and maintaining secure systems and software are defined and understood]
- Secure Software Development and Product Security
- [Development Standards]
- [Security Requirements]
- Secure Software Development and Product Security
[6.2 Bespoke and custom software are developed securely]
- Secure Software Development and Product Security
- [Secure Development Standards]
- [Code Review Process]
- Secure Software Development and Product Security
[6.3 Security vulnerabilities are identified and addressed]
- Vulnerability Management
- [Vulnerability Management Process]
- [Security Testing]
- Vulnerability Management
[6.4 Public-facing web applications are protected against attacks]
- Secure Software Development and Product Security
- [Web Application Security]
- [Security Controls]
- Secure Software Development and Product Security
[6.5 Changes to all system components are managed securely]
- Configuration and Change Management
- [Change Management Process]
- [Release Management]
- Configuration and Change Management
[Restrict Access to System Components and Cardholder Data by Business Need to Know]
[7.1 Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understood]
- Access
- [Access Control Policy]
- [Access Management]
- Access
[7.2 Access to system components and data is appropriately defined and assigned]
- Access
- [Access Management]
- [Role Based Access]
- Access
[7.3 Access to system components and data is managed via an access control system(s)]
- Access
- [Access Controls]
- [System Configuration]
- Access
[Identify Users and Authenticate Access to System Components]
[8.1 Processes and mechanisms for identifying users and authenticating access to system components are defined and understood]
- Access
- [Authentication Standards]
- [Identity Management]
- Access
[8.2 User identification and related accounts for users and administrators are strictly managed throughout an account's lifecycle]
- Access
- [User Management]
- [Authentication Controls]
- Access
[8.3 Strong authentication for users and administrators is established and managed]
- Access
- [Authentication Security]
- [Credential Management]
- Access
[8.4 Multi-factor authentication (MFA) is implemented to secure access into the CDE]
- Access
- [MFA Implementation]
- [Authentication Controls]
- Access
[8.5 Multi-factor authentication (MFA) systems are configured to prevent misuse]
- Access
- [MFA Management]
- [System Configuration]
- Access
[8.6 Use of application and system accounts and associated authentication factors is strictly managed]
- Access
- [Account Management]
- [System Access]
- Access
[Restrict Physical Access to Cardholder Data]
[9.1 Processes and mechanisms for restricting physical access to cardholder data are defined and understood]
- Physical Security
- [Facility Access]
- [Entry Controls]
- Physical Security
[9.2 Physical access controls manage entry into facilities and systems containing cardholder data]
- Physical Security
- [Access Control Systems]
- [Facility Security]
- Physical Security
[9.3 Physical access for personnel and visitors is authorized and managed]
- Physical Security
- [Visitor Management]
- [Access Logs]
- Physical Security
[9.4 Media with cardholder data is securely stored, accessed, distributed, and destroyed]
- Mobile Device Security and Media Management
- [Media Protection]
- [Media Management]
- Mobile Device Security and Media Management
[9.5 Point of interaction (POI) devices are protected from tampering and unauthorized substitution]
- Physical Security
- [Device Security]
- [Tampering Prevention]
- Physical Security
[Log and Monitor All Access to System Components and Cardholder Data]
[10.1 Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documented]
- System Audits, Monitoring and Assessments
- [Audit Logging]
- [Access Monitoring]
- System Audits, Monitoring and Assessments
[10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events]
- System Audits, Monitoring and Assessments
- [Automated Logging]
- [System Monitoring]
- System Audits, Monitoring and Assessments
[10.3 Audit logs are protected from destruction and unauthorized modifications]
- System Audits, Monitoring and Assessments
- [Logging Requirements]
- [Audit Records]
- System Audits, Monitoring and Assessments
[10.4 Audit logs are reviewed to identify anomalies or suspicious activity]
- System Audits, Monitoring and Assessments
- [Log Review]
- [Security Monitoring]
- System Audits, Monitoring and Assessments
[10.5 Audit log history is retained and available for analysis]
- System Audits, Monitoring and Assessments
- [Log Protection]
- [Audit Trail Security]
- System Audits, Monitoring and Assessments
[10.6 Time-synchronization mechanisms support consistent time settings across all systems]
- Configuration and Change Management
- [Time Synchronization]
- [System Configuration]
- Configuration and Change Management
[10.7 Failures of critical security control systems are detected, reported, and responded to promptly]
- System Audits, Monitoring and Assessments
- [Security Monitoring]
- [Incident Response]
- System Audits, Monitoring and Assessments
[Test Security of Systems and Networks Regularly]
[11.1 Processes and mechanisms for regularly testing security of systems and networks are defined and understood]
- Vulnerability Management
- [Wireless Security]
- [Network Scanning]
- Vulnerability Management
[11.2 Wireless access points are identified and monitored, and unauthorized wireless access points are addressed]
- Vulnerability Management
- [Vulnerability Scanning]
- [Security Assessment]
- Vulnerability Management
[11.3 External and internal vulnerabilities are regularly identified, prioritized, and addressed]
- Vulnerability Management
- [Penetration Testing]
- [Security Testing]
- Vulnerability Management
[11.4 External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected]
- Threat Detection and Prevention
- [IDS/IPS Implementation]
- [Security Monitoring]
- Threat Detection and Prevention
[11.5 Network intrusions and unexpected file changes are detected and responded to]
- Configuration and Change Management
- [Change Detection]
- [File Integrity Monitoring]
- Configuration and Change Management
[11.6 Unauthorized changes on payment pages are detected and responded to]
- Vulnerability Management
- [Security Testing]
- [Test Procedures]
- Vulnerability Management
[Support Information Security with Organizational Policies and Programs]
[12.1 A comprehensive information security policy that governs and provides direction for protection of the entity's information assets is known and current]
- Security Architecture and Operating Model
- [Security Policy]
- [Policy Management]
- Security Architecture and Operating Model
[12.2 Acceptable use policies for end-user technologies are defined and implemented]
- HR and Personnel Security
- [Acceptable Use]
- [Technology Standards]
- HR and Personnel Security
[12.3 Risks to the cardholder data environment are formally identified, evaluated, and managed]
- Risk Management and Risk Assessment Process
- [Risk Assessment Methodology]
- [Risk Analysis]
- Risk Management and Risk Assessment Process
[12.4 PCI DSS compliance is managed]
- Roles, Responsibilities and Training
- [Assignment of Roles and the Security Committee]
- [Responsibilities]
- Roles, Responsibilities and Training
[12.5 PCI DSS scope is documented and validated]
- Roles, Responsibilities and Training
- [Security Organization]
- [Management Structure]
- Roles, Responsibilities and Training
[12.6 Security awareness education is an ongoing activity]
- HR and Personnel Security
- [Security Training]
- [Awareness Program]
- HR and Personnel Security
[12.7 Personnel are screened to reduce risks from insider threats]
- HR and Personnel Security
- [Personnel Screening]
- [Background Checks]
- HR and Personnel Security
[12.8 Risk to information assets associated with third-party service provider (TPSP) relationships is managed]
- Third Party Security and Vendor Risk Management
- [Vendor Management]
- [Service Provider Controls]
- Third Party Security and Vendor Risk Management
[12.9 Third-party service providers (TPSPs) support their customers' PCI DSS compliance]
- Third Party Security and Vendor Risk Management
- [Vendor Compliance]
- [Service Provider Assessment]
- Third Party Security and Vendor Risk Management
[12.10 Suspected and confirmed security incidents that could impact the CDE are responded to immediately]
- Incident Response
- [Incident Management Process]
- [Incident Categories and Playbooks]
- Breach Investigation and Notification
- [Breach Investigation Process]
- [Response Procedures]
- Incident Response