Want a Word document copy of the entire policy template? Sign up for the PCI DSS Guru newsletter and receive a free copy that you can edit and use in your organization!
(12.3) For critical employee-facing technologies (inclusive of remote access technologies, wireless technologies, removable electronic media, email usage, internet usage, laptops, and personal data/digital assistants), departmental procedures shall require:
- (12.3.1) explicit management approval to use the devices
- (12.3.2) that all device use is authenticated with username and password or other authentication item (for example, token)
- (12.3.3) a list of all devices and personnel authorized to use the devices
- (12.3.4) labeling of devices with owner, contact information, and purpose
- (12.3.8) automatic disconnect of remote access technology sessions after a specific period of inactivity
- (12.3.9) activation of remote access technologies used by vendors only when needed by vendors, with immediate deactivation after use
Departmental usage standards shall include:
- (12.3.5) acceptable uses for the technology
- (12.3.6) acceptable network locations for the technology
- (12.3.7) a list of company-approved products
- (12.3.10) prohibition of the storage of cardholder data onto local hard drives and removable electronic media when accessing such data via remote access technologies
- (12.3.10) prohibition of copy, move, storage and print functions during remote access
March 18th, 2010 on 8:10 am
12.3.4 “Purpose”… Who with a security minded expertise would label their critical(eq sensitive!) systems with their purpose!?!?! Dont get this at all…
July 21st, 2010 on 9:56 am
I agree completely however I did put red stickers on my backups stating ‘credit card info please steal and hack.’ It’s important to be mindlessly compliant.
September 17th, 2010 on 10:53 am
Labeling doesn’t need to be human readable nor does it need to contain the actual purpose of the device directly. The best way to do this is to place a CODE on each device and that code then in turn has a lookup on some other secured document. The logic is that you won’t have a device sitting around wondering “what is this for”. It would be stupid to directly label any device as demonstrated by the previous comments which are totally correct and very entertaining at the same time.
July 16th, 2011 on 1:46 am
How is it that I by no means thought of this?