Audit Question	Select Y/N
Do you use vendor-supplied defaults for system passwords and other security parameters?	yes No
Do you Install and maintain a firewall configuration to protect cardholder data?	yes No
Do you protect the stored data of the card holder?	yes No
If your organization stores PAN, Do you render it unreadable?	yes No
Do you Encrypt transmission of cardholder data across open, public networks?	yes No
Do you fully document and implement key management processes and procedures for cryptographic keys used for encryption of cardholder data?	yes No
Do you develop and maintain secure systems and applications?	yes No
Do you develop internal and external software applications including web-based administrative access to applications in accordance with PCI DSS and based on industry best practices?	yes No
Do you protect your all systems against malware?	yes No
Do you Implement Strong Access Control Measures?	yes No
Do you establish an access control system(s) for systems components that restricts access based on a user’s need to know, and is set to “deny all” unless specifically allowed?	yes No
Do you restrict physical access to cardholder data?	yes No
Do you track and monitor all access to network resources and cardholder data?	yes No
Do you implement a process for timely detection and reporting of failures of critical security control systems?	yes No
Do you regularly test security systems and processes?	yes No
Do you examine the compliance of system components in scope following the testing procedures for each PCI DSS requirement?	yes No
Do you have a Qualified Security Assessor (QSA) is a data security firm that is qualified by the PCI Security Standards Council to perform on-site PCI DSS assessments?	yes No
Do you identify and authenticate access to system components?	yes No
Do you track and monitor all access to network resources and cardholder data?	yes No
Do you use a third-party service to store, process, or transmit cardholder data on their behalf, or to manage CDE components?	yes No
Do you maintain a policy that addresses information security for all personnel?	yes No

Submit