2.2.2System components are configured and managed securely

Defined Approach Requirements:

Vendor default accounts are managed as follows:

- If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6.

- If the vendor default account(s) will not be used, the account is removed or disabled.

Defined Approach Testing Procedures:

2.2.2.a Examine system configuration standards to verify they include managing vendor default accounts in accordance with all elements specified in this requirement.

2.2.2.b Examine vendor documentation and observe a system administrator logging on using vendor default accounts to verify accounts are implemented in accordance with all elements specified in this requirement.

2.2.2.c Examine configuration files and interview personnel to verify that all vendor default accounts customized approach objective that will not be used are removed or disabled.