PCI Requirement 12.3.5 – Acceptable Uses of the Technology

by Randy Bartels / December 22, 2022

 Acceptable Use Policies Your usage policies, as stated in PCI Requirement 12.3.5, should detail acceptable uses of the technology at your organization. Acceptable use policies (AUP) normally have users agree to not use the services for illegal purposes, not attempt to harm the security of the technology or system, and to report any suspicious activity. The PCI DSS explains that by defining acceptable uses of the technology, your organization…

PCI Requirement 12.3.4 – A Method to Accurately and Readily Determine Owner, Contact Information, and Purpose

by Randy Bartels / December 16, 2022

 Identification System Your usage policies should have a method for identifying who an asset-owner is. PCI Requirement 12.3.4 specifically details, “A method to accurately and readily determine owner, contact information, and purpose.” This doesn’t mean you need a label on every device defining who the owner is, but you do need to have an identification system. This could be a serial number that traces back to the owner. Without…

PCI Requirement 12.3.3 – A List of All Devices and Personnel with Access

by Randy Bartels / December 16, 2022

 Approved Devices and Personnel with Access To create compliant usage policies, your organization must meet PCI Requirement 12.3.3, which requires you to keep a list of all devices and personnel with access. Lists of approved devices and personnel come up often in the PCI DSS and PCI Requirement 12.3.3. Without this list of all devices and personnel with access, an attack could place their own devices on your network,…

PCI Requirement 12.3.2 – Authentication for Use of the Technology

by Randy Bartels / December 16, 2022

 Proper Authentication in Usage Policies We learned about authentication methods in PCI Requirement 7, and that ties in here. The more people who have access to cardholder data, the more risk there is. A crucial aspect of usage policies is authentication. PCI Requirement 12.3.2 says that usage policies must require authentication for the use of technology. If technology is implemented without proper authentication methods, malicious individuals may use this…

PCI Requirement 12.3.1 – Explicit Approval by Authorized Parties

by Randy Bartels / December 16, 2022

 Who Approves Usage Policies? Your usage policies, as stated in PCI Requirement 12.3.1, should require explicit approval by authorized parties. The PCI DSS explains that if your usage policies do not require formal approval for implementation of critical technologies, your personnel may innocently implement a solution to a perceived business need, but also open a gap that puts critical systems and cardholder data at risk. To test compliance with…