PCI DSS v4.0/Requirement 02: Apply Secure Configurations to All System Components/26 of 250
2.2.5System components are configured and managed securely
Control family: Requirement 02: Apply Secure Configurations to All System Components
Control description
Defined Approach Requirements:
If any insecure services, protocols, or daemons are present:
- Business justification is documented.
- Additional security features are documented and implemented that reduce the risk of using insecure services, protocols, or daemons.
Defined Approach Testing Procedures:
2.2.5.a If any insecure services, protocols, or daemons are present, examine system configuration standards and interview personnel to verify they are managed and implemented in accordance with all elements specified in this requirement.
2.2.5.b If any insecure services, protocols, or daemons, are present, examine configuration settings to verify that additional security features are implemented to reduce the risk of using insecure services, daemons, and protocols.