PCI-DSS Policy Mapping Table - Information Shield

PCI-DSS Policy Mapping Table The following table provides a high-level mapping between the security requirements of the Payment Card Industry Data Security Standard V3* (PCI-DSS) and the security policy categories of Information Security Policies Made Easy (ISO 27002). ISPME also provides policy coverage for many areas not specifically mentioned in the high-level requirements, but specified in the detailed requirements of the standard.

Security Topics and Requirements

Specific Sections and Policies

Build and Maintain a Secure Network 1: Install and maintain a firewall configuration to protect data

Firewall Management Policy Network Security Management Policy 10.6.1 Network Controls (Firewalls)

2: Do not use vendor-supplied defaults for system passwords and other security parameters 2.1 Change vendor-supplied defaults for passwords and unnecessary accounts. 2.2 System Configuration Standards 2.3 Encrypt Administrator Access 24. Inventory of System Components

Password Management Policy 11.5.3 Password Management System (26 policies) (11.5.3-23. Vendor Default Passwords)

Protect Cardholder Data 3: Protect stored cardholder data 3.1 Data storage, retention and disposal policies 3.2 Do not store authentication data 3.3 Mask PAN display 3.4 Render PAN data unreadable 3.5 Implement encryption key procedures 3.6 Document key management policies 3.7 Distribute policies to key personnel 4: Encrypt transmission of cardholder data and sensitive information across public networks 4.1 Use strong cryptography and security protocols 4.2 Protect PANs in end-user messaging technologies 4.3 Distribute related policies to key personnel

Information Ownership Policy Backup and Recovery Policy 11.5.1 Secure log-on procedures 11.5.2 User identification and authentication 11.6.1 Information access restriction 11.6.2 Sensitive system isolation 12.3 Cryptographic Controls

Information Exchange Security Policy 10.8 Exchange of Information 10.9.3 Electronic Commerce Security 12.3 Cryptographic Controls

Maintain a Vulnerability Management Program 5: Protect all systems against malware and regularly update anti-virus software or programs 5.1 Deploy anti-virus software on all systems 5.2 Maintain anti-malware system configuration 5.3 Protect anti-malware systems from tampering

Malicious Software Management Policy 10.4.1 Controls against malicious code. 10.4.2 Controls against mobile code

5.4 Distribute related policies to key personnel 6: Develop and maintain secure systems and applications 6.1 Identify and Rank Vulnerabilities 6.2 Apply security patches 6.3 Secure software development 6.4 Change control procedures 6.5 Address coding vulnerabilities 6.6 Protect public-facing web applications 6.7 Distribute related policies to key personnel

Change Management Policy 10.3.2 System Acceptance (12 policies) 12.4.1 Control of operational software 12.5.1 Change Control Procedures (25 policies) Web Site Security Policy

Implement Strong Access Control Measures 7: Restrict access to cardholder data by business need-to-know

Access Control Security Policy

7.1 Limit access to authorized personnel 7.2 Establish access control systems 7.3 Distribute related policies to key personnel

11.1.1 Access control policy 11.2.2 Privilege Management 11.2.2-1 Need To Know 11.2.4 Review of user access rights

8: Identify and authenticate access to system components

Account and Privilege Management Policy Remote Access Security Policy

8.1 Effective userid and privilege management 8.2 Implement passwords or strong authentication 8.3 Two-factor authentication for remote access 8.4 Educate users on strong authentication 8.5 Do not use shared authentication credentials 8.6 Manage alternative access control systems 8.7 Restrict database access 8.8 Distribute policies to key personnel

11.2.1 User Registration 11.2.3 User Password Management (12 polices) 11.5.2 User Identification And Authentication (6 policies)

9: Restrict physical access to cardholder data

Physical Security Policy

9.1 Facility physical access controls 9.2 Identify personnel and visitors (badges) 9.3 Personnel Physical access management 9.4 Visitor handling procedures 9.5 Physically secure all media 9.6 Protect media in transit 9.7 Protect media in storage 9.8 Properly destroy media 9.9 Protect card capture devices* 9.10 Distribute physical policies to key personnel

9 Physical And Environmental Security 9.1.1 Physical security perimeter (7 policies) 9.1.2 Physical entry controls (26 policies) 9.1.3 Securing offices, rooms, and facilities (5 policies) 9.2.6 Secure disposal or re-use of equipment 9.2.7 Removal of property 11.3.3 Clear desk and clear screen policy (8 policies)

Regularly Monitor and Test Networks 10: Track and monitor all access to network resources and cardholder data 10.1 System audit trails for use access 10.2 System audit data requirements 10.3 System log data standards

Log Management and Monitoring Policy 10.10.1 Audit logging (11 policies) 10.10.2 Monitoring system use 10.10.4 Administrator and operator logs 10.10.5 Fault logging

10.4 Clock synchronization 10.5 Protect system audit trails 10.6 Review logs and security events (standards) 10.7 Retain audit logs 10.8 Distribute audit policies to key personnel

10.2.2 Monitoring and review of third party services 15.3.1 System Audit Controls (3 policies)

11: Regularly test security systems and processes.

Wireless Security Policy Network Security Management Policy

11.1 Monitor wireless access points 11.2 Run internal and external vulnerability scans 11.3 Perform system penetration testing 11.4 Implement IDS and IPS systems 11.5 Change detection and file integrity software 11.6 Distribute policies to key personnel

6.1.3-14 Authorization To Review Any Information System 15.2 Reviews Of Security Policy And Technical Compliance

Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security for all personnel. 12.1 Establish, publish, maintain, and disseminate a security policy. 12.2 Formal risk assessment process 12.3 Acceptable usage policies 12.4 Define information security roles 12.5 Assign specific information security roles 12.6 Format security awareness program 12.7 Employee screening procedures 12.8 Service provider management 12.9 Addition service provider security * 12.10 Incident response planning and procedures

30+ Security Policy Sample Documents: Information Security Program Policy IT Risk Assessment Policy Acceptable Use of Assets Policy Personnel Security Management Policy Third Party Security Policy Incident Management Policy 5.1 INFORMATION SECURITY POLICY 5.1.1 Information security policy document 5.1.2 Review of the information security policy 8.2.2 Information security awareness, education, and training

* Based on the Payment Card Industry Data Security Standard (PCI-DSS) Version 3.0, available from the PCI Standards Council. For more information a security policy solutions for PCI compliance visit our Regulatory Resource Center at http://www.informationshield.com