PCI DSS Requirement 2 | Default Vendor Passwords and Settings | PCI Compliance Security Templates

PCI Requirement 2, “Do not use vendor-supplied defaults for system passwords and other security parameters”, requires merchants and service providers to essentially provision, harden, secure and lock-down all system components within the cardholder data environment (CDE).  Simply stated, system components need to be configured for ultimately ensuring their safety and security, which essentially means having formalized and documented processes in place.  For an ounce of clarity, when the PCI DSS standards – which can be obtained by downloading a copy from pcisecuriystandards.org – use words, phrases, and terms, such as “developed configuration standards”, “enable”, and “implement security features”, this requires following a checklist, adhering to a stated policy or procedure, documenting an action – etc. – in essence, these are actions that require PCI policies and procedures to be in place.  

PCI Compliance Policies | Understanding the True Intent of the PCI DSS Standards
For example, a provision within the PCI DSS standards requires organizations to conduct the following: Verify that system components are configured and hardened with industry leading standards, such as SANS or NIST. The word “verify” essentially means to develop a policy, procedure or some type of document stating what configuration standards are used, for what system components along with any other necessary information.  Also keep in mind that many of the PCI security policies may not be stated in an absolute manner, so you will have to “read between the lines” at times for making sure your organization has all essential documentation in place.

PCI Compliance Security Templates & Policies for SAQ A – D, P2PE-HW, and Onsite Assessments
pcipolicyportal.com is the industry leader in providing documented policies and procedures for PCI DSS compliance, and has developed policy and procedural forms, checklists, and templates applicable to each of the following PCI DSS requirements for merchants and service providers:

•    SAQ A for Merchants
•    SAQ B for Merchants
•    SAQ C for Merchants
•    SAQ C-VT for Merchants
•    SAQ D for Merchants and Service Providers
•    SAQ P2PE-HW for Merchants
•    Onsite Assessments by PCI-QSA for Merchants and Service Providers

Purchase and immediately download your PCI Policies Packet today for SAQ A, B, C, C-VT, D, P2PE-HW, and Level 1 onsite assessments.

With policies and procedures that are mapped specifically to each of the PCI DSS reporting requirements for merchants and service providers, pcipolicyportal.com should be your only choice for PCI policies. Additionally, contact us today if you need an onsite assessment (also known as Level 1 assessments) by an actual Payment Card Industry Qualified Security Assessor (QSA).

PCI Policy Writing Experts | Join us for Free PCI Webinars to Learn More about Compliance
Learn more about our policy and procedure writing services, the PCI certification process for both the Self-Assessment Questionnaires (SAQ A – D), and Level 1 onsite assessments and the need for PCI compliance security templates for compliance.  Additionally, we also offer policy writing services, along with hosting free PCI webinars, so join us!