6

In the PCI DSS standard (v3.1), 4.1(i) reads:

For all other environments using SSL and/or early TLS: Review the documented Risk Mitigation and Migration Plan to verify it includes:

  • Description of usage, including what data is being transmitted, types and number of systems that use and/or support SSL/early TLS, type of environment;
  • Risk-assessment results and risk-reduction controls in place;

  • Description of processes to monitor for new vulnerabilities associated with SSL/early TLS;

  • Description of change control processes that are implemented to ensure SSL/early TLS is not implemented into new environments;

  • Overview of migration project plan including target migration completion date no later than June 30, 2016.

However, in SAQ D this text is in 4.1(g) and there is no (i).

Why is there a difference?

I checked and this appears to be the same in v3.2 too (and also for the merchant SAQ-D).

| improve this question | |
  • In PCI DSS 3.2 the coverage of SSL and early TLS is moved to appendix A.2 and is flagged in 4.1(h). This additional color is conceptually a part of 4.1(g) which deals in general with the implementation of TLS. SSL and "early TLS" are considered to be insecure implementations of TLS and if still in use have to have controls. – Jonah Benton Sep 6 '16 at 13:04
  • But that's 4.1(e) in the SAQ and 4.1(g) in the standard. That is my question - surely the SAQ for the standard should match the standards document? – SilverlightFox Sep 6 '16 at 18:43
  • I see- those are not meant to line up, except at the MAJOR.MINOR requirement level. The "testing procedures" column (and "guidance" as well) in the PCI DSS doc are for a QSA or for someone preparing for a QSA visit. The SAQ is for self-assessors. The concerns are going to be a little different. A QSA will be involved in a more complex or more risky assessment, when an SAQ is not sufficient. – Jonah Benton Sep 6 '16 at 22:13
  • The relevant point may be- if you are in a situation where you are trying to decide which to pay attention to- there is a granular decision made by your acquirer as to whether you are eligible for SAQ. If you are, then just answer the SAQ and use the DSS doc (and others) for guidance and color. If you are not, then ignore the SAQ. :) – Jonah Benton Sep 6 '16 at 22:16
  • Ah, see also that this refers to the service provider saq. There the determination of saq vs qsa- level 2 vs level 1- is based on number of transactions processed yearly for one or the other of the card brands. – Jonah Benton Sep 6 '16 at 22:54
1

Distilling from comments:

The PCI DSS standards document contains the requirements language and also contains testing procedures (column 2) and guidance (column 3) for QSAs and for those preparing for a visit by a QSA. The requirements are numbered in MAJOR.MINOR format and the testing procedures appropriate for a requirement use letters. The testing procedures are not themselves requirements.

The SAQ is a questionnaire for self-assessors. The questions appropriate to a particular PCI DSS requirement also use letters under the MAJOR.MINOR requirement format.

The lettering in these two documents are not intended to line up. Testing procedures and guidance for QSAs are different than questions intended for self-assessment.

If one qualifies to self-assess, then one can use the testing procedures and guidance in the requirements document to deepen one's understanding of the expectations of compliance, but one is only responsible for answering the questions in the SAQ.

If one does not qualify to self-assess them then SAQ should be ignored.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.