2.2 System components are configured and managed securely.
This requirement focuses on ensuring that all system components are configured and managed securely. It addresses the implementation of secure configuration standards, management of vendor default accounts, separation of security functions, minimizing enabled services, securing necessary insecure services, configuring system security parameters, and encrypting administrative access.
Sub-requirements:
- 2.2.1 Configuration standards are developed, implemented, and maintained to:
- 2.2.2 Vendor default accounts are managed as follows:
- 2.2.3 Primary functions requiring different security levels are managed as follows:
- 2.2.4 Only necessary services, protocols, daemons, and functions are enabled, and all unnecessary functionality is removed or disabled.
- 2.2.5 If any insecure services, protocols, or daemons are present:
- 2.2.6 System security parameters are configured to prevent misuse.
- 2.2.7 All non-console administrative access is encrypted using strong cryptography.
2.2. System components are configured and managed securely.
Ensure all system components are hardened, vendor defaults are changed, and only necessary functions are enabled to minimize vulnerabilities.
Key Risks
Frequently Asked Questions
What does Requirement 2.2 require for vendor defaults?
All vendor-supplied default passwords and settings must be changed before systems are used in production.
How should system components be hardened?
By disabling unnecessary services, protocols, and accounts, and applying secure configuration standards.
What about insecure protocols?
Insecure protocols must be identified, documented, and protected with compensating controls or replaced.
How is configuration management enforced?
Through baseline configuration templates, change management, and regular reviews.
Why is inventory management important?
Maintaining an accurate inventory ensures all systems are accounted for and properly managed.
Common QSA Questions
Can you provide evidence that vendor defaults have been changed?
Yes, we maintain configuration records and audit logs showing all default credentials and settings have been updated.
How do you manage and review system inventories?
We use automated tools and manual reviews to keep our inventory current and accurate.
How do you handle insecure protocols or legacy systems?
We document all insecure protocols in use and apply compensating controls or work to replace them with secure alternatives.
Your perspective on this PCI DSS requirement matters! Share your implementation experiences, challenges, or questions below. Your insights help other organizations improve their compliance journey and build a stronger security community.Comment Policy