PCI-DSSペーシーアイ Compliance Checker

Do you have firewalls installed and configured to protect cardholder data?

Is there a network diagram showing all connections to cardholder data?

Have all vendor-supplied default passwords been changed?

Are system hardening standards documented and applied to all components?

Is stored cardholder data encrypted using strong cryptography?

Do you have data retention policies limiting storage of cardholder data?

Is cardholder data encrypted during transmission over public networks (TLS 1.2+)?

Is anti-malware software deployed on all systems commonly affected by malware?

Are anti-malware solutions kept current with automatic updates?

Are critical security patches installed within one month of release?

Do you follow secure coding practices (OWASP) for custom applications?

Is access to cardholder data restricted to personnel with business need?

Is there a role-based access control system with documented roles?

Does every user have a unique ID for system access?

Is MFA implemented for all access to the cardholder data environment?

Is physical access to cardholder data areas restricted and monitored?

Are media containing cardholder data physically secured and tracked?

Are all access to cardholder data logged with audit trails?

Are logs reviewed daily and retained for at least one year?

Do you conduct quarterly vulnerability scans by an ASV?

Do you conduct annual penetration testing?

Do you have intrusion detection/prevention systems monitoring the CDE?

Do you have a documented information security policy reviewed annually?

Do all personnel receive security awareness training upon hire and annually?