PCI Requirement 12.3.10 – For Personnel Accessing Cardholder Data via Remote-Access Technologies, Prohibit the Copying, Moving, and Storage of Cardholder Data onto Local Hard Drives and Removable Electronic Media

by Randy Bartels / December 22, 2022

 Employees with Remote-Access If you have employees who can access your cardholder data environment from remote-access technologies, you must comply with PCI Requirement 12.3.10. It states, “For personnel accessing cardholder data via remote-access technologies, prohibit the copying, moving, and storage of cardholder data onto local hard drives and removable electronic media, unless explicitly authorized for a defined business need. Where there is an authorized business need, the usage policies…

PCI Requirement 12.3.9 – Activation of Remote-Access Technologies for Vendors and Business Partners Only When Needed

by Randy Bartels / December 22, 2022

 Vendor Management in Usage Policies Organizations on the road to PCI compliance must recognize the importance of vendor management. Your usage policies should include a vendor management aspect, outlined by PCI Requirement 12.3.9, “Activation of remote-access technologies for vendors and business partners only when needed by vendors and business partners, with immediate deactivation after use.” Wherever you have vendors and business partners come into your environment, we’re going to…

PCI Requirement 12.3.8 – Automatic Disconnect of Sessions for Remote-Access Technologies After a Specific Period of Inactivity

by Randy Bartels / December 22, 2022

 Automatic Disconnect in Your Usage Policies Remote-access technologies are a constant source of risk for critical resources and cardholder data. This is why PCI Requirement 12.3.8 requires that your usage policies include, “Automatic disconnect of sessions for remote-access technologies after a specific period of inactivity.” In PCI Requirement 8.1.8, we gave you this scenario: A user walks away from an open machine that has access to critical system components…

PCI Requirement 12.3.7 – List of Company-Approved Products

by Randy Bartels / December 22, 2022

 Acceptable Products Your usage policies, as stated in PCI Requirement 12.3.7, should include a list of company-approved products. This list will correlate with your acceptable uses of technology policy to create strong and secure usage policies. The PCI DSS explains that by defining company-approved products, your organization will be better equipped to manage and control gaps in configurations and operational controls, ensuring that a back door is not opened…

PCI Requirement 12.3.6 – Acceptable Network Locations for the Technologies

by Randy Bartels / December 22, 2022

 Acceptable Network Locations Your usage policies, as stated in PCI Requirement 12.3.6, should detail acceptable network locations for the technology at your organization. The PCI DSS explains that by defining acceptable network locations, your organization will be better equipped to manage and control gaps in configurations and operational controls, ensuring that a back door is not opened for attackers. To test compliance with PCI Requirement 12.3.6, an assessor will…