Now,
requirement 2.4 always causes a QSA to smile because this is one of
those requirements that really shows the age of PCI DSS.
Bless it.
It would like a system inventory.
And in the system inventory will be a list of everything,
that servers, workstations,
and networking devices which are in scope of PCI DSS's requirements.
This can come from a configuration management database,
or CMDB, or it could be a set of spreadsheets,
or it could just be whatever system you use internally to
track your assets and build an inventory.
It might also be what's included in some sort of asset
discovery and asset management tool.
You know, historically, inventorying physical assets was pretty easy.
I mean, it's pretty easy to understand what should be in the inventory,
even if the maintenance of the inventory itself is actually
almost impossible in a large organization.
You know, and when we come to virtual and cloud-based assets,
it gets much harder.
So really at this stage,
the QSA is going to be looking to understand how you maintain the list
of all the components that are in scope for PCI DSS,
and that may well involve, for instance,
using cloud-based images that are configured in such a way that
they automatically update an electronic inventory or
configuration system when they're spun up.
Although the concept of an inventory might seem old fashioned,
you would be surprised to know how many breaches of cardholder data
came via systems that the merchant or service provider claimed they
didn't even know existed on the network.
And if you don't know components are on your network
or systems are on your network,
how can you make sure they're patched and updated and you do the
vulnerability management and they've got a hardened build?
So, a hard requirement to implement,
but one that's really pretty important for security.
To test this requirement, the QSA is going to look at the system inventory,
and then they're going to talk to the people who are
responsible for maintaining it.