RM-05—Self-Assessments: PCI

>Control Description

On a quarterly basis, reviews shall be performed with approved documented specification to confirm personnel are following security policies and operational procedures pertaining to: • daily log reviews • firewall rule-set reviews • applying configuration standards to new systems • responding to security alerts • change management processes

Theme

Process

Type

Preventive

Policy/Standard

Risk Management Standard

>Implementation Guidance

1. Establish a quarterly process to ensure that the following policies and operational procedures are being reviewed and approved by authorized personnel: • daily log reviews • firewall rule-set reviews • applying configuration standards to new systems • responding to security alerts • change management processes

>Testing Procedure

1. Inspect whether a process exists for reviewing the following on a quarterly basis: • daily log reviews • firewall rule-set reviews • applying configuration standards to new systems • responding to security alerts • change management processes 2. Validate using the last review whether any deviations were noted and if applicable, were tracked till resolution