Security Testing & Monitoring Policy
Updated: January 1, 2026
Approved By: Jennifer Lyssy, CEO
1. Purpose
The purpose of this policy is to define the processes and responsibilities for regularly testing the security of systems and networks to ensure the protection of cardholder data and compliance with PCI DSS requirements.
Regular testing ensures that vulnerabilities are identified, prioritized, and remediated before they can be exploited, thereby reducing the risk of security incidents.
2. Scope
This policy applies to all systems, networks, applications, and personnel involved in storing, processing, or transmitting cardholder data, including all components of the Cardholder Data Environment (CDE).
—
## 3. Policy Statement
[Company Name] will maintain a structured and ongoing security testing program that includes vulnerability scanning, penetration testing, intrusion detection, and change monitoring to protect systems and data from unauthorized access or compromise.
All security testing activities will be documented, maintained, actively used, and communicated to relevant personnel.
—
4. Roles and Responsibilities
### Security Officer / IT Lead
– Owns and maintains this policy
– Ensures all testing is completed and documented
– Reviews results and ensures remediation
### IT / Technical Personnel
– Perform or coordinate scans and monitoring
– Maintain systems and tools
– Address identified vulnerabilities
### All Personnel
– Report suspicious activity
– Follow security procedures and training
—
## 5. Security Testing Requirements
### 5.1 Security Testing Plan
A formal security testing plan will:
– Identify all systems and processes requiring testing
– Define testing frequency
– Specify testing methods (scans, penetration tests, monitoring)
– Be reviewed and updated at least annually
—
### 5.2 Wireless Access Point Monitoring
– All wireless access points must be inventoried and approved
– The environment must be scanned for unauthorized wireless devices at least quarterly (every 3 months)
– Unauthorized devices must be investigated and removed
—
### 5.3 Vulnerability Scanning
#### Internal Scans
– Performed at least quarterly
– Performed after any significant system change
– Must identify and remediate high-risk and critical vulnerabilities
– Rescans must confirm remediation
#### External Scans
– Performed at least quarterly
– Conducted by a PCI-approved scanning vendor (ASV)
– Must meet passing scan requirements
– Rescans required until passing
—
### 5.4 Penetration Testing
– Conducted at least annually and after significant changes
– Includes both external and internal testing
– Covers network-layer and application-layer vulnerabilities
– Includes validation of segmentation (if used)
– Results must be documented and retained for at least 12 months
– All findings must be remediated and retested
—
### 5.5 Intrusion Detection & Prevention
– Intrusion detection and/or prevention systems (IDS/IPS) must be implemented
– Monitoring must occur at the perimeter of the CDE and at critical internal network points
– Alerts must be generated for suspicious activity
– Systems must be kept up to date
—
### 5.6 File Integrity Monitoring
– Tools must detect unauthorized changes to critical files
– Monitoring must include file changes, additions, and deletions
– File comparisons must occur at least weekly
– Alerts must be sent to appropriate personnel
—
### 5.7 Payment Page Integrity Monitoring
– Mechanisms must detect unauthorized changes to payment page scripts and HTTP headers
– Monitoring must occur at least weekly or based on defined risk analysis
– Alerts must be generated for any unauthorized modifications
—
## 6. Vulnerability Management
– All vulnerabilities must be identified, prioritized based on risk, and remediated in a timely manner
– High-risk and critical vulnerabilities must be addressed immediately
– Lower-risk vulnerabilities must be managed based on defined risk tolerance
—
## 7. Documentation & Recordkeeping
– All testing activities must be documented and retained for at least 12 months
– Documentation must be available for audit review
– Records include scan results, penetration test reports, remediation actions, and monitoring logs
—
## 8. Compliance
Failure to comply with this policy may result in disciplinary action and potential legal consequences.
—
## 9. Policy Review
This policy will be reviewed at least annually and updated as needed to reflect changes in systems, risks, or regulatory requirements.
—
## 10. Acknowledgment
All applicable personnel must acknowledge and adhere to this policy.
