PCI DSS INFORMATION SECURITY POLICY – MARSHALL’S FARM
This policy represents the policy of Marshall’s Farm in its role as a Service Provider.
I. INTRODUCTION
To maintain the ability of merchants to accept payment cards, safeguard its payment card customers, and protect its cardholder data environment, Marshall’s Farm (‘Company’) must take adequate security measures. As a result, this information security policy reflects the Company’s commitment to comply with the latest applicable Payment Card Industry Data Security Standard (PCI DSS) as mandated by its acquiring bank and the payment card brands.
The Company can minimize inappropriate exposures, loss, and inappropriate use of cardholder data by complying with PCI DSS, attending to the proper design and control of systems in scope of PCI DSS, and applying sanctions when violations of this security policy occur.
Security is the responsibility of everyone who uses the Company’s information technology resources to accept payment cards on its behalf. It is the responsibility of merchants, employees, contractors, business partners, and agents of the Company. Each party must become familiar with this policy’s provisions and the importance of adhering to it when using the Company’s services, computers, networks, data, and other resources to accept payment cards. Each party is responsible for reporting any suspected breaches of its terms. As such, all parties authorized to accept payment cards on their own behalf or on behalf of the Company must adhere to relevant policies and procedures mandated by the Company, and PCI DSS.
II. PURPOSE / SCOPE
The primary purpose of this security policy is to establish rules to ensure the protection of cardholder data and to ensure protection of the Company’s resources in scope of PCI DSS. The policy assigns responsibility and provides guidelines to protect the Company’s cardholder data and cardholder data environment against misuse and/or loss.
This security policy applies to the Company’s cardholder data environment as defined by PCI DSS and all devices that connect to the cardholder data environment.
This security policy has been written to specifically address the security of data used by the Payment Card Industry. Cardholder data must be protected and security controls must conform to PCI DSS.
III. DEFINITIONS
Acquiring Bank: Also referred to as acquirer or acquiring financial institution. Entity that initiates and maintains relationships with merchants for the acceptance of payment cards.
Attestation of Compliance (AOC): The Company’s certification that it is eligible to perform.
Cardholder: Non-consumer or consumer customer to whom a payment card is issued to or any individual authorized to use the payment card.
Cardholder Data: At a minimum, cardholder data consists of the full primary account number (PAN). Cardholder data may also appear in the form of the full PAN plus any of the following: cardholder name, expiration date and/or service code.
Cardholder Data Environment: The people, processes and technology that store, process or transmit cardholder data or sensitive authentication data, including any connected system components.
Merchant: For the purposes of the PCI DSS, a merchant is defined as any entity that uses the AspDotNetStorefront hosted services and accepts payment cards bearing the logos of any of the five members of PCI Security Standards Council (American Express, Discover, JCB, MasterCard, or Visa) as payment for goods and/or services.
Primary Account Number (PAN): Also referred to as account number. Unique payment card number (typically for credit or debit cards) that identifies the issuer and the particular cardholder account.
Self-Assessment Questionnaire (SAQ): Tool used by any entity to validate its own compliance with PCI DSS and in filing an AOC.
Sensitive Authentication Data: Security-related information (including but not limited to card validation codes/values) used to authenticate cardholders and/or authorize payment card transactions.
Service Provider: Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data. This also includes companies that provide services that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls, IDS, and other services as well as hosting providers and other entities. In this case, Vortx, Inc, dba AspDotNetStorefront, is a service provider.
IV. SECURITY POLICY OWNERSHIP AND RESPONSIBILITIES
It is the responsibility of the custodians of this security policy to publish and disseminate these policies to all relevant system users (including merchants, vendors, contractors, and business partners) authorized to accept payment cards on behalf of the Company. Also, the custodians must see that the security policy addresses and complies with PCI DSS. This policy document will be reviewed at least annually by the custodians (and any relevant data owners) and updated as needed to reflect changes to business objectives or the risk environment.
Questions or comments about this policy should be sent to the policy custodians at support@vortx.com
V. COMPANY MERCHANT REQUIREMENTS
The following outlines general and technical requirements for all merchants who operate on behalf of the Company where applicable:
A. Only authorized (registered) merchants may use the Company’s resources to host their store, thorugh which they accept payment cards.
B. All merchants take responsibility for their own PCI compliance.
C. All merchants must complete the appropriate PCI DSS Self-Assessment Questionnaire (SAQ) and Attestation of Compliance (AOC) as required by their acquiring banks.
D. Marshall’s Farm will annually file the appropriate Attestation of Compliance with its acquiring bank.
VI. BUILD AND MAINTAIN A SECURE NETWORK
In order to protect cardholder data, it is critical to design and maintain a secure network infrastructure where this data may be electronically processed or transmitted. The Company will maintain such a secure network isolated from all other hosted networks. All system components in the Service Provider CDE (cardholder data environment) will operate in this secure network.
The following technical requirements cover the network infrastructure (hardware such as firewalls, routers, and switches) as well as requirements for the secure configuration of all cardholder data environment system components.
1.0 Install and Maintain a Firewall Configuration
All systems must be protected from unauthorized access from untrusted networks, whether entering the system via the Internet as e-commerce, employee internet access through desktop browsers, employee e-mail access, dedicated connections such as business-to-business connections, via wireless networks, or via other sources. Often, seemingly insignificant paths to and from untrusted networks can provide unprotected pathways into key systems. Firewalls are a key protection mechanism for any computer network.
1.1 Firewall/Router Configuration Documentation
The Company will have documented firewall/router configuration standards that include the following:
- A formal process for approving and testing all network connections and changes to the firewall and router configurations. (PCI DSS Requirement 1.1.1)
- Current network diagrams, which must be updated after any change to the network or cardholder data environment, with all connections to cardholder data. (PCI DSS Requirement 1.1.2)
- Firewalls present between each public network segment, including the internet, and the cardholder data environment. (PCI DSS Requirement 1.1.3)
- Firewall configuration documentation naming the individuals responsible for logical management of the firewalls/routers. (PCI DSS Requirement 1.1.4)
- Firewall configuration documentation containing a detailed list of inbound and outbound services, protocols, and ports required for daily business. This list must contain a description and justification for use of the required services, protocols, and ports on all firewall interfaces. (PCI DSS Requirement 1.1.5)
- Firewall and router rule sets reviewed at least every 6 months. (PCI DSS Requirement 1.1.6)
1.2 Restrict Connections between Untrusted Network Segments and the Cardholder Data Environment
The Company will restrict connections from untrusted network segments to system components within the cardholder data environment by doing the following:
- Building and maintaining firewall rules to limit all inbound and outbound traffic to/from the cardholder data environment to only those sites required for business as determined by the Company. (PCI DSS Requirement 1.2.1.a)
- Building and maintaining firewall rules to explicitly deny all other inbound and outbound traffic. (PCI DSS Requirement 1.2.1.b)
- Verifying router configuration files are secure and synchronized – for example, running configuration files and startup configuration files have the same, secure configuration. (PCI DSS Requirement 1.2.2)
1.3 Prohibit Direct Public Access between the Internet and the Cardholder Data Environment
The Company will prohibit direct public access between the internet and any system component in the cardholder data environment by doing the following:Implementing a DMZ to limit inbound traffic to system components that provide authorized publicly accessible services, protocols, and ports. (PCI DSS Requirement 1.3.1)Limiting inbound internet traffic to IP addresses within the DMZ. (PCI DSS Requirement 1.3.2)Prohibiting direct network routes (inbound or outbound) between the internet and the cardholder data environment. (PCI DSS Requirement 1.3.3)Prohibiting internal IP addresses (e.g., RFC 1918 address ranges) to pass from the internet into the cardholder data environment. (PCI DSS Requirement 1.3.4)Verifying that outbound traffic from the cardholder data environment to the internet is explicitly authorized. (PCI DSS Requirement 1.3.5)Verifying use of firewall hardware that implements stateful inspection, also known as dynamic packet filtering (only established connections should be allowed in and only if they are associated with a previously established session). (PCI DSS Requirement 1.3.6)Verifying that system components that store cardholder data are on an internal network zone, segregated from the DMZ and other untrusted networks. (PCI DSS Requirement 1.3.7)Preventing disclosure of private IP addresses and routing information from internal networks to the internet using technologies such as NAT, PAT, RFC 1918 address space, etc. (PCI DSS Requirement 1.3.8.a)Verifying disclosure of private IP addresses and routing information to external entities is authorized. (PCI DSS Requirement 1.3.8.b)
1.4 Personal Firewall Required on Mobile Computers
- Personal firewalls must be installed and active on all mobile and/or employee-owned computers with direct connectivity to the internet (for example, laptops used by employees), and which are used to access the cardholder data environment. (PCI DSS Requirement 1.4.a)
- Personal firewall software must be configured by the Company to its specified standards and must not be alterable by mobile computer users. (PCI DSS Requirement 1.4.b)
2.0 Change Vendor Supplied Defaults
The Company’s general policy is to always change vendor-supplied defaults for system passwords or other security parameters before systems are installed in the cardholder data environment.
Individuals with malicious intent (external and internal to an organization) often use vendor default passwords and other vendor default settings to compromise systems. These passwords and settings are well known by hacker communities and are easily determined via public information.
2.1 Change Vendor Supplied Defaults
- All vendor-supplied defaults must be changed on all system components before being used in the cardholder data environment. (Examples include: passwords, simple network management protocol (SNMP) community strings, and elimination of unnecessary accounts, etc.) (PCI DSS Requirement 2.1)
- The Company prohibits processing payment card transactions using WiFi.
2.2 Develop Configuration Standards
The Company’s policy is to:
- Develop configuration standards for all system components. Assure that these standards address all known vulnerabilities and are consistent with industry-accepted system hardening standards. (PCI DSS Requirement 2.2)
- Implement only one primary function per server to prevent functions that require different security levels from co-existing on the same server. (PCI DSS Requirement 2.2.1)
- Enable only necessary and secure services, protocols, daemons, etc., as required for the function of the system. (PCI DSS Requirement 2.2.2)
- Configure system security parameters to prevent misuse. (PCI DSS Requirement 2.2.3)
- Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers. (PCI DSS Requirement 2.2.4)
2.3 Encrypt All Non-console Administrative Access Using Strong Cryptography
The Company’s policy is that:
- Strong cryptography must be used for any non-console and/or web-based management interface used for administration of systems and/or system components. (Use technologies such as SSH, VPN, or SSL/TLS for web-based management and other non-console administrative access.) (PCI DSS Requirement 2.3)
VII. PROTECT CARDHOLDER DATA
Cardholder data must be protected. To mitigate the risk of unauthorized access, the Company prohibits electronic storage of cardholder data. When required, merchants may store paper cardholder data per the following:
3.0 Protect Stored Cardholder Data
3.1 Minimize Stored Cardholder Data
- The Company prohibits electronic storage of all cardholder data such as the Primary Account Number (PAN).
- Only store paper cardholder data in a secure location if necessary for business purposes and then securely destroy such physical copies after authorizing transactions (see Policy Section 9.0).
3.2 Do Not Store Sensitive Authentication Data
- Never store sensitive authentication data after authorization (even if encrypted). Sensitive Authentication Data includes card verification codes/values. (PCI DSS Requirement 3.2)
3.3 Mask Primary Account Number (PAN) When Displayed
- Mask PAN when displayed (the first six or last four digits are the maximum number of digits to be displayed). Since the Company forbids electronic storage of PAN, this should never be necessary. (PCI DSS Requirement 3.3)
4.0 Encrypt Transmission of Cardholder Data Over Open, Public Networks
Cardholder data must be encrypted during transmission over networks that are easily accessed by individuals with malicious intent. Improperly configured wireless networks and vulnerabilities in legacy encryption and authentication protocols can be continued targets of individuals with malicious intent who exploit these vulnerabilities to gain privileged access to cardholder data environments.
Note transmission of encrypted cardholder data over public networks does not mean transmission via end user messaging, printing, scanning, and faxing, all of which the Company prohibits per the following:
4.1 Use Strong Cryptography and Security Protocols
- Strong encryption algorithms and protocols (for example, SSL/TLS, IPSEC, SSH, etc.) must be used whenever cardholder data is transmitted or received over open, public networks. (PCI DSS Requirement 4.1)
4.2 Transmission of Cardholder Data via End User Messaging Technologies
- The Company prohibits storing, processing, or transmitting cardholder data via end-user messaging technologies (for example, e-mail, instant messaging, short message service, multimedia messaging service, etc.).
- If employees receive unsolicited cardholder data via end-user messaging, they must not process the transaction and permanently delete the original message. Employees must create a new message stating the original transaction did not process and make alternate arrangements to collect payment information (for example, online or via phone).
4.3 Transmission of Cardholder Data via Printing, Faxing, and Scanning
- The Company prohibits printing, faxing, and scanning of cardholder data.
- Printing, faxing, and scanning cardholder data disproportionately increases the Company’s PCI scope to include print, fax, document imaging, and email servers and anything connected to such systems.
- If employees receive unsolicited cardholder data via fax, they must not process the transaction and instead securely destroy paper faxes with cardholder data per Policy Section 9.0. If they receive an unsolicited fax via the Company’s fax server, they must permanently delete the associated email. Employees must contact the sender and make alternate arrangements to collect payment information (for example, online or via phone).
VIII. MAINTAIN A VULNERABILITY MANAGEMENT PROGRAM
System components within the cardholder data environment must be part of an active vulnerability maintenance program. The following requirements ensure system components are protected from malicious software and vulnerabilities that result from software bugs and improperly patched applications and operating systems.
5.0 Use and Regularly Update Anti-Virus Software or Programs
Malicious software, commonly referred to as malware—including viruses, worms, and Trojans—enters a sensitive network segment during many business approved activities including employees’ e-mail and use of the internet, mobile computers, and storage devices, resulting in the exploitation of system vulnerabilities. Anti-virus software must be used on all systems commonly affected by malware to protect systems from current and evolving malicious software threats.
5.1 Deploy Anti-Virus Software
- Anti-virus software must be deployed on all systems in the cardholder data environment commonly affected by malicious software. This includes personal computers, servers, etc. connected to the cardholder data environment. (PCI DSS Requirement 5.1)
- Anti-virus programs must be capable of detecting, removing, and protecting against all known types of malicious software (adware, spyware, etc.). (PCI DSS Requirement 5.1.1)
5.2 Regularly Update Anti-Virus Software and Maintain Logs
- All anti-virus software and associated definition files must be kept current at all times. (PCI DSS Requirement 5.2.a)
- The master installation of anti-virus software maintained by the Company must be enabled for automatic updates and periodic scans. (PCI DSS Requirement 5.2.b)
- Systems components must be verified to have anti-virus automatic updates and periodic scans enabled. (PCI DSS Requirement 5.2.c)
- Anti-virus software log generation must be enabled and logs must be retained for one year in accordance with PCI DSS Requirement 10.7. (PCI DSS Requirement 5.2d)
6.0 Develop and Maintain Secure Systems and ApplicationsIndividuals with malicious intent use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities can be fixed by applying vendor-provided security patches. All critical systems must have the most recently released, appropriate software patches to protect against exploitation and compromise of cardholder data by individuals with malicious intent and the use of malicious software. Note: Appropriate software patches are those patches that have been evaluated and tested sufficiently to determine that the patches do not conflict with existing security configurations. For in-house developed applications, the introduction of vulnerabilities can be avoided by using standard system development processes and secure coding techniques.
6.1 Install Security Patches Promptly
- All cardholder data environment system components and software must have the latest vendor-supplied system security patches installed. (PCI DSS Requirement 6.1)
- All critical cardholder data environment system and software patches must be installed within 30 days of vendor release. (PCI DSS Requirement 6.1)
6.2 Identify New Security Vulnerabilities
The Company Information Technology Division will establish and maintain a process to identify and assign a risk ranking to newly discovered security vulnerabilities. (PCI DSS Requirement 6.2)
6.3 The Company will not develop or customize payment applications.
IX. IMPLEMENT STRONG ACCESS CONTROL MEASURES
Access to system components and software within the cardholder data environment must be controlled and restricted to those with a business need for that access. The Company achieves this through the use of active access control systems, strong controls on user and password management, and restricting physical access to critical or sensitive components and software to individuals with a “need to know”.
7.0 Restrict Access to Cardholder Data by Business Need to Know
To ensure cardholder data can only be accessed by authorized personnel, systems and processes must be in place to limit access based on need-to-know and according to job responsibilities.
Need-to-know refers to when access rights are granted to the least amount of data and privileges needed to perform a job (least privileges model).
7.1 Limit Access to Cardholder Data
- Access to cardholder data and system components in the cardholder data environment must be restricted to only those individuals whose job requires such access. (PCI DSS Requirement 7.1) Access limitations must include:
- Restriction of access rights of privileged user IDs to least privileges necessary to perform job responsibilities. (PCI DSS Requirement 7.1.1)
- Assignment of privileges based on individual personnel’s job classification and function. (PCI DSS Requirement 7.1.2)
- Requirement for a documented approval by authorized parties specifying required privileges. (PCI DSS Requirement 7.1.3)
- Implementation of an automated access control system. (PCI DSS Requirement 7.1.4)
7.2 Restrict Access to Need to Know
- Establish an access control system for systems components in the cardholder data environment with multiple users that restricts access based on a user’s need to know and is set to “deny all” unless specifically allowed. (PCI DSS Requirement 7.2)This access control system must include the following:
- Coverage of all system components in the cardholder data environment. (PCI DSS Requirement 7.2.1)
- Assignment of privileges to individuals based on job classification and function. (PCI DSS Requirement 7.2.2)
8.0 Assign a Unique ID to Each Person with Computer Access
Assigning a unique identification (ID) to each person with access ensures that each individual is uniquely accountable for his or her actions. When such accountability is in place, actions taken on critical data and systems are performed by, and can be traced to, known and authorized users. The Company ensures such accountability by employing the following practices:
Note: These requirements are applicable for all accounts, including point-of-sale accounts with administrative capabilities and all accounts used to view or access cardholder data or to access systems with cardholder data.
8.1 Assign All Users a Unique ID
- All users must be assigned a unique ID before allowing them to access systems components in the cardholder data environment or cardholder data. (PCI DSS Requirement 8.1)
8.2 Authenticate All Users
The Company must employ at least one of the following methods to authenticate all users: (PCI DSS Requirement 8.2)
- Something you know, such as a user ID and a password or passphrase
- Something you have, such as a token device or smart card
- Something you are, such as a biometric device.
8.3 Incorporate Two-Factor Authentication for Remote Access
- The Company requires all employees, administrators, and third parties to use two-factor authentication for remote access to the cardholder data environment. (PCI DSS Requirement 8.3)
- Remote access refers to network-level access originating from outside the Cardholder Data environment.
8.4 Encrypt All Passwords
All passwords must be rendered unreadable during transmission and storage on all cardholder data environment system components using strong cryptography. (PCI DSS Requirement 8.4)
8.5 Ensure Proper User Identification and Authentication Management
The Company must ensure proper user identification and authentication management for non-consumer users and administrators on all cardholder data environment system components as follows: (PCI DSS Requirement 8.5)
- Control addition, deletion, and modification of user ID’s, credentials, and other identifier objects. (PCI DSS Requirement 8.5.1)
- Verify user identity before performing password resets by phone, e-mail, web, or other non-face-to-face methods. (PCI DSS Requirement 8.5.2)
- Set passwords for first-time use and resets to a unique value for each user and change immediately after the first use. (PCI DSS Requirement 8.5.3)
- Immediately revoke access for any terminated users. (PCI DSS Requirement 8.5.4)
- Remove/disable inactive user accounts at least every 90 days. (PCI DSS Requirement 8.5.5)
- Enable accounts used by vendors for remote access only during the time period needed. Monitor vendor remote access accounts when in use. (PCI DSS Requirement 8.5.6)
- Communicate authentication procedures and policies to all users who have access to cardholder data. (PCI DSS Requirement 8.5.7)
- Do not use group, shared, or generic accounts and passwords, or other authentication methods. (PCI DSS Requirement 8.5.8)
- Change user passwords at least every 90 days. (PCI DSS Requirement 8.5.9)
- Require a minimum password length of at least seven characters. (PCI DSS Requirement 8.5.10)
- User passwords containing both numeric and alphanumeric characters. (PCI DSS Requirement 8.5.11)
- Do not allow an individual to submit a new password that is the same as any of the last four passwords he or she has used. (PCI DSS Requirement 8.5.12)
- Limit repeated access attempts by locking out the user ID after not more than six attempts. (PCI DSS Requirement 8.5.13)
- Set the lockout duration to a minimum of 30 minutes or until an administrator enables the user ID. (PCI DSS Requirement 8.5.14)
- If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session. (PCI DSS Requirement 8.5.15)
9.0 Restrict Physical Access to Cardholder Data
Any physical access to cardholder data or systems within the cardholder data environment provides the opportunity for individuals to access devices, data, systems, or hardcopies and should be appropriately restricted. The Company must mitigate such risk using the following controls:
9.1 Use Facility Entry Controls
Use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment as follows: (PCI DSS Requirement 9.1)
- Use video cameras and/or access control mechanisms to monitor individual physical access to sensitive areas. Review collected data and correlate with other entries. Store video for at least three months, unless otherwise restricted by law. (PCI DSS Requirement 9.1.1)
- Note: Sensitive areas refers to any data center, server room or any area that houses systems that store, process, or transmit cardholder data.
- Restrict physical access to publicly accessible network jacks. For example, areas accessible to visitors should not have network ports enabled unless network access is explicitly authorized. (PCI DSS Requirement 9.1.2)
- Restrict physical access to wireless access points, gateways, handheld devices, networking/communications hardware, and telecommunication lines. (PCI DSS Requirement 9.1.3)
9.2 Use Employee Identification
- Develop procedures to easily distinguish between onsite personnel and visitors, especially in areas where cardholder data is accessible. (PCI DSS Requirement 9.2)
- Review processes and procedures for assigning badges to onsite personnel and visitors, and verify these processes include granting new badges, changing access requirements, and revoking terminated onsite personnel and expired visitor badges (PCI DSS Requirement 9.2.a)
- Verify that access to the badge systems is limited to authorized personnel. (PCI DSS Requirement 9.2.b)
- Examine badges in use to verify that they clearly identify visitors and it is easy to distinguish between onsite personnel and visitors. (PCI DSS Requirement 9.2.c)
9.3 Badge All Visitors
All visitors must be handled as follows: (PCI DSS Requirement 9.3)
- Authorized before entering areas where cardholder data is processed or maintained. (PCI DSS Requirement 9.3.1)
- Given a physical token (for example, a badge or access device) that expires and that identifies the visitors as not onsite personnel. (PCI DSS Requirement 9.3.2)
- Asked to surrender the physical token before leaving the facility or at the date of expiration. (PCI DSS Requirement 9.3.3)
9.4 Use a Visitor Log
Use a visitor log to maintain a physical audit trail of visitor (i.e., any person whether Company employee or vendor without access permission) activity. Document the visitor’s name, the firm represented, and the onsite personnel authorizing physical access on the log. Retain this log for a minimum of three months, unless otherwise restricted by law. (PCI DSS Requirement 9.4)
9.5 Store Paper Cardholder Data in a Secure Location
Store paper cardholder data in a secure location, preferably an off-site facility, such as an alternate or back-up site, or commercial storage facility. Review the location’s security at least annually. (PCI DSS Requirement 9.5)
9.6 Physically Secure All Paper Cardholder Data
All stored paper cardholder data approved by the Office of Business and Finance must be stored in a locked enclosure, such as a locked drawer, locked box, or safe. Only employees with a business need to access paper cardholder data will have access to such locked enclosures.
9.7 Maintain Strict Control over Paper Cardholder Data Distribution
Maintain strict control over the internal or external distribution of any paper cardholder data, including the following: (PCI DSS Requirement 9.7)
- Classify paper cardholder data so the sensitivity of the data can be determined. (PCI DSS Requirement 9.7.1)
- Send the paper cardholder data by secured courier or other delivery method that can be accurately tracked. (PCI DSS Requirement 9.7.2)
9.8 Require Management Approval to Move Paper Cardholder Data• Employees must maintain logs documenting management approval prior to moving paper cardholder data. (PCI DSS Requirement 9.7.1)
9.9 Maintain Strict Control over Paper Cardholder Data Storage and Accessibility• Properly maintain inventory logs of all paper cardholder data and conduct media inventories at least annually. (PCI DSS Requirement 9.9.1)
9.10 Destroy Paper Cardholder Data When No Longer Needed
Destroy paper cardholder when no longer needed for business or legal reasons as follows: (PCI DSS Requirement 9.10)
- Shred, incinerate, or pulp hardcopy materials so that cardholder data cannot be reconstructed. (PCI DSS Requirement 9.10.1)
- Verify hardcopy materials are crosscut shredded, incinerated, or pulped such that there is reasonable assurance they cannot be reconstructed. (PCI DSS Requirement 9.10.1.a)
X. REGULARLY MONITOR AND TEST NETWORKS
Important components of overall system security for the cardholder data environment are the regular testing of networks for exposed vulnerabilities and the continuous monitoring of security indicators (logs, system events, etc.). The Company must address system monitoring and vulnerability testing using the following policies:
10.0 Track and Monitor Access to Network Resources and Cardholder Data
Logging mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise. The presence of logs in all environments allows thorough tracking, alerting, and analysis when something does go wrong. Determining the cause of a compromise is very difficult, if not impossible, without system activity logs, and the Company will maintain such logs according to the following:
10.1 Establish an Audit Process
Establish a process for linking all access to system components (especially access done with administrative privileges such as root) to each individual user. (PCI DSS Requirement 10.1)
10.2 Implement User-Based Auditing
Implement automated audit trails for all system components to reconstruct the following events: (PCI DSS Requirement 10.2)
- All individual accesses to cardholder data. (PCI DSS Requirement 10.2.1)
- All actions taken by any individual with root or administrative privileges. (PCI DSS Requirement 10.2.2)
- Access to audit trails. (PCI DSS Requirement 10.2.3)
- Invalid logical access attempts. (PCI DSS Requirement 10.2.4)
- Use of identification and authentication mechanisms. (PCI DSS Requirement 10.2.5)
- Initialization of the audit logs. (PCI DSS Requirement 10.2.6)
- Creation and deletion of system-level objects. (PCI DSS Requirement 10.2.7)
10.3 Log System Events
Record at least the following audit trail entries for all system components for each event: (PCI DSS Requirement 10.3)
- User identification (PCI DSS Requirement 10.3.1)
- Type of event (PCI DSS Requirement 10.3.2)
- Date and time (PCI DSS Requirement 10.3.3)
- Success or failure indication (PCI DSS Requirement 10.3.4)
- Origination of event (PCI DSS Requirement 10.3.5)
- Identity or name of affected data, system component, or resource (PCI DSS Requirement 10.3.6)
10.4 Synchronize System Clocks
Using time-synchronization technology (for example, network time protocol), synchronize all critical system clocks and times and ensure that the following is implemented for acquiring, distributing, and storing time: (PCI DSS Requirement 10.4)
- Critical systems have the correct and consistent time. (PCI DSS Requirement 10.4.1)
- Time data is protected. (PCI DSS Requirement 10.4.2)
- Time settings are received from industry-accepted time sources. (PCI DSS Requirement 10.4.3)
10.5 Secure Audit Trails
- Secure audit trails so they cannot be altered. (PCI DSS Requirement 10.5)
- Limit viewing of audit trails to those with a job-related need. (PCI DSS Requirement 10.5.1)
- Protect audit trail files from unauthorized modifications. (PCI DSS Requirement 10.5.2)
- Promptly back up audit trail files to a centralized log server or media that is difficult to alter. (PCI DSS Requirement 10.5.3)
- Write logs for external facing technologies onto a log server on the internal LAN. (PCI DSS Requirement 10.5.4)
- Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed with generating alerts (although new data being added should not cause an alert). (PCI DSS Requirement 10.5.5)
10.6 Review Audit Logs Daily
Review logs for all system components at least daily. Log reviews must include those servers that perform security functions like intrusion-detection systems (IDS) and authentication, authorization, and accounting protocol (AAA) servers (for example, RADIUS). (PCI DSS Requirement 10.6) Note: Log harvesting, parsing, and alerting tools may be used to meet compliance with Requirement 10.6.
10.7 Retain Audit Trail History
Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restored from back-up). (PCI DSS Requirement 10.7)
11.0 Regularly Test Security Systems and ProcessesVulnerabilities are being discovered continually by malicious individuals and researchers and introduced by new software. Cardholder data environment system components, processes, and custom software must be tested frequently to ensure security controls continue to reflect a changing environment.
11.1 Rogue Wireless Network Detection
The Information Technology Division must test for the presence of wireless access points and detect unauthorized wireless access points on a quarterly basis using Enterasys wireless detection sensors. (PCI DSS Requirement 11.1)
11.2 Perform Internal and External Vulnerability Scans Quarterly
- Internal vulnerability assessment scans must be performed at least quarterly and after any significant change in the cardholder data environment (such as new system component installations, changes in network topology, firewall rule modifications, product upgrades). (PCI DSS Requirement 11.2.1)
- External vulnerability scans must be performed at least quarterly. Scans must be run on all external IP addresses that could be used to gain access to the cardholder data environment. (PCI DSS Requirement 11.2.2)
- Systems failing a vulnerability assessment scan (either internal or external) are to be remediated and retested until a passing scan is achieved. (PCI DSS Requirement 11.2)
- Results of each quarter’s internal and external vulnerability assessments are to be documented and retained for review. (PCI DSS Requirement 11.2)
- The Company must perform internal and external scans after any significant change. (PCI DSS Requirement 11.2.3) Note: Scans conducted after changes may be performed by internal staff.
11.3 Perform Internal and External Penetration Testing
Perform external and internal penetration testing at least once a year and after any significant infrastructure or application upgrade or modification (such as an operating system upgrade or a sub-network or web server added to the environment). These penetration tests must include the following: (PCI DSS Requirement 11.3)
- Network-layer penetration tests. (PCI DSS Requirement 11.3.1)
- Application-layer penetration tests. (PCI DSS Requirement 11.3.2)
11.4 Use IDS and IPS
Use intrusion-detection systems and/or intrusion-prevention systems to monitor all traffic at the perimeter of, as well as at, critical points inside the cardholder data environment and alert personnel to suspected compromises. Keep all intrusion detection and prevention engines, baselines, and signatures up-to-date. (PCI DSS Requirement 11.4)
11.5 Deploy File Integrity Monitoring
Deploy file-integrity monitoring tools to alert personnel to unauthorized modification of critical system files, configuration files, or content files. Configure the software to perform critical file comparisons at least weekly. (PCI DSS Requirement 11.5)
Note: For file-integrity monitoring purposes, critical files are usually those that do not regularly change, but the modification of which could indicate a system compromise or risk of compromise. File-integrity monitoring products usually come pre-configured with critical files for the related operating system. Other critical files, such as those for custom applications, must be evaluated and defined by the entity (that is, the merchant or service provider).
XI. MAINTAIN AN INFORMATION SECURITY POLICY
Without strong security policies and procedures, many layers of security controls become ineffective at preventing data breaches. Unless consistent policies and practices are adopted and followed at all times, security controls break down due to inattention and poor maintenance. The following policies address maintaining the Company’s payment card security policies described above:
12.0 Maintain an Information Security Policy for Employees
A strong security policy sets the security tone for the Company and informs employees what is expected of them. All employees should be aware of the sensitivity of data and their responsibilities for protecting it.
Note: Employees refers to full-time and part-time employees, temporary employees and personnel, and contractors and consultants who are resident on the Company’s site or otherwise have access to the cardholder data environment.
12.1 Implement an Information Security Policy
The Company must establish, publish, maintain, and disseminate a security policy that accomplished the following:
- Addresses all PCI DSS requirements. (PCI DSS Requirement 12.1.1)
- Includes an annual process that identifies threats and vulnerabilities and results in a formal risk assessment. (PCI DSS Requirement 12.1.2)
- Includes a review at least annually and updates when the environment changes. (PCI DSS Requirement 12.1.3)
12.2 Develop PCI DSS Operational Procedures
The Company must develop daily operational security procedures that are consistent with the requirements in this specification (for example, user account maintenance procedures and log review procedures). (PCI DSS Requirement 12.2)
12.3 Develop Usage Policies for Critical Technologies
- Explicit approval by authorized parties. (PCI DSS Requirement 12.3.1)
- Authentication for use of the technology. (PCI DSS Requirement 12.3.2)
- A list of devices and personnel with access. (PCI DSS Requirement 12.3.3)
- Labeling of devices to determine the owner, contact information, and purpose. (PCI DSS Requirement 12.3.4)
- Acceptable uses of the technology. (PCI DSS Requirement 12.3.5)
- Acceptable network locations for the technologies. (PCI DSS Requirement 12.3.6)
- List of Company-approved products. (PCI DSS Requirement 12.3.7)
- Automatic disconnect of sessions for remote-access technologies after a specific period of inactivity. (PCI DSS Requirement 12.3.8)
- Activation of remote-access technologies for vendors and business partners only when needed by vendors and business partners, with immediate deactivation after use. (PCI DSS Requirement 12.3.9)
- For personnel accessing cardholder data via remote-access technologies, prohibit copy, move, and storage of cardholder data onto local hard drives and removable electronic media, unless explicitly authorized for a defined business need. (PCI DSS Requirement 12.3.10)
12.4 Define Security Responsibilities
The Company must ensure the security policies and procedures clearly define information security responsibilities for all personnel. (PCI DSS Requirement 12.4).
12.5 Assign Security Management Responsibilities
The Company must assign an individual or team the following information security management responsibilities: (PCI DSS Requirement 12.5)
- Establish, document, and distribute security policies and procedures. (PCI DSS Requirement 12.5.1)
- Monitor and analyze security alerts and information, and distribute to appropriate personnel. (PCI DSS Requirement 12.5.2)
- Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations. (PCI DSS Requirement 12.5.3)
- Administer user accounts, including additions, deletions, and modifications. (PCI DSS Requirement 12.5.4)
- Monitor and control all access to data. (PCI DSS Requirement 12.5.5)
12.6 Implement a Security Awareness Program
The Company must implement a formal security awareness program to make all personnel aware of the importance of cardholder data security. The program must include the following: (PCI DSS Requirement 12.6)
- Educate personnel upon hire and at least annually. (PCI DSS Requirement 12.6.1) Note: Methods can vary depending on the role of the personnel and their level of access to cardholder data.
- Require personnel to acknowledge at least annually they have read and understood the security policy and procedures. (PCI DSS Requirement 12.6.2)
12.7 Screen Employees
The Company must screen potential personnel prior to hire to minimize the risk of attacks from internal sources. (Examples of background checks include previous employment history, criminal record, credit history, and reference checks.) (PCI DSS Requirement 12.7)
12.8 Extend PCI DSS to Third Parties
If cardholder data is shared with service providers, the Company must maintain and implement policies and procedures to manage service providers, to include the following: (PCI DSS Requirement 12.8)
- Maintain a list of service providers. (PCI DSS Requirement 12.8.1)
- Maintain a written agreement that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess. (PCI DSS Requirement 12.8.2)
- Ensure there is an established process for engaging service providers including proper due diligence prior to engagement. (PCI DSS Requirement 12.8.3)
- Maintain a program to monitor service providers’ PCI DSS compliance status at least annually. (PCI DSS Requirement 12.8.4)
12.9 Implement an Incident Response Plan
The Company must implement an incident response plan to be prepared to immediately respond to a system breach according to the following: (PCI DSS Requirement 12.9)
- Create the incident response plan to be implemented in the event of a system breach. Ensure the plan addresses the following, at a minimum: (PCI DSS Requirement 12.9.1)
- Roles, responsibilities, and communication and contact strategies in the event of a compromise including notification of the payment brands, at a minimum.
- Specific incident response procedures.
- Business recovery and continuity procedures.
- Data back-up processes.
- Analysis of legal requirements for reporting compromises.
- Coverage and responses to all critical system components.
- Reference or inclusion of incident response procedures from the payment brands.
- Test the plan at least annually. (PCI DSS Requirement 12.9.2)
- Designate specific personnel to be available on a 24/7 basis to respond to alerts. (PCI DSS Requirement 12.9.3)
- Provide appropriate training to staff with security breach response responsibilities. (PCI DSS Requirement 12.9.4)
- Include alerts from intrusion-detection, intrusion-prevention, and file-integrity monitoring systems. (PCI DSS Requirement 12.9.5)
- Develop a process to modify and evolve the incident response plan according to lessons learned and to incorporate industry developments. (PCI DSS Requirement 12.9.6)
COVERAGE OF RESPONSIBILITY
- Establish, document, and distribute security policies: Executive Director
- Monitor, analyze, and distribute security alerts and information: Executive Director
- Establish, document, and distribute security incident response and escalation policies: Executive Director
- Administration of user accounts on systems in the cardholder data environment: Executive Director
- Monitor and control all access to cardholder data: Executive Director