PCI DSS Compliance Audit Tool

The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance cardholder data security and contains a number of requirements that must be met.

XIA Configuration provides a broad spectrum of configuration and security information within its configuration management database (CMDB) which helps to support PCI DSS.

In addition, specific reports have been created that assist you in providing information aligned to the PCI DSS requirements.

Requirement 2.1

2.1 Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network.

XIA Configuration includes the report 'Always change default passwords (Windows SNMP)' which allows you to see the SNMP community strings assigned to Windows PCs and servers in the environment and highlights systems using the default read or write community strings.

Requirement 2.2.1

2.2.1 Implement only one primary function per server.

XIA Configuration provides the ability to view what functions (roles) a server is providing.

Report

This information is accessed in the reporting section which allows servers running multiple functions to be easily identified.

Requirement 8.1.4

8.1.4 Remove/disable inactive user accounts within 90 days.

The XIA Configuration Client can be configured to automatically gather information about Active Directory user accounts including their last logon information. This allows an administrator to easily identify enabled, but inactive computer accounts.

Requirement 8.1.6

8.1.6 Limit repeated access attempts by locking out the user ID after not more than six attempts.

Account lockout policy information is gathered directly from each server and workstation by the XIA Configuration Client and can be viewed on a machine by machine basis.

Report

This information can also be accessed within the reporting section which allows both servers and workstations that do not comply to be easily identified.

Requirement 8.1.7

8.1.7 Set the lockout duration to a minimum of 30 minutes or until an administrator enables the user ID.

This requirement is covered within the same report as requirement 8.1.6.

Requirement 8.2.3

8.2.3 Passwords/phrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters.

Password policy information is gathered directly from each server and workstation by the XIA Configuration Client and can be viewed on a machine by machine basis.

Report

This information can also be accessed within the reporting section which allows both servers and workstations that do not comply to be easily identified.

Requirement 8.2.4

8.2.4 Change user passwords/passphrases at least every 90 days.

This information can be reported against for both machines within the environment and from fine-grained password policies configured for Active Directory domains within the environment.

Requirement 8.2.5

8.2.5 Do not allow an individual to submit a new password/phrase that is the same as any of the last four passwords/phrases he or she has used.

This information can be reported against for both machines within the environment and from fine-grained password policies configured for Active Directory domains within the environment.

Requirement 10.4.1

10.4.1 Critical systems have the correct and consistent time

Windows

Display the Windows Time settings configured for your Windows Machines across all your environments.

ESX

Similar information is also available for VMware ESX hosts.