PCI DSS v4.0/Requirement 02: Apply Secure Configurations to All System Components/22 of 250
2.2.1System components are configured and managed securely
Control family: Requirement 02: Apply Secure Configurations to All System Components
Control description
Defined Approach Requirements:
Configuration standards are developed, implemented, and maintained to:
- Cover all system components.
- Address all known security vulnerabilities.
- Be consistent with industry-accepted system hardening standards or vendor hardening recommendations.
- Be updated as new vulnerability issues are identified, as defined in Requirement 6.3.1.
- Be applied when new systems are configured and verified as in place before or immediately after a system component is connected to a production environment.
Defined Approach Testing Procedures:
2.2.1.a Examine system configuration standards to verify they define processes that include all elements specified in this requirement.
2.2.1.b Examine policies and procedures and interview personnel to verify that system configuration standards are updated as new vulnerability issues are identified, as defined in Requirement 6.3.1.
2.2.1.c Examine configuration settings and interview personnel to verify that system configuration standards are applied when new systems are configured and verified as being in place before or immediately after a system component is connected to a production environment