PCI DSS Requirement 2: Secure Configurations and Default Passwords

Requirement 2 Structure

Deep Dives

• 2.2.1 - Configuration standards cover all system components, address known vulnerabilities, align with industry/vendor hardening, update as new issues are identified (per 6.3.1), and are applied before or immediately after production connection.
• 2.2.2 - Vendor default accounts: change the default password per 8.3.6 if kept, or remove/disable if unused. Applies to OS, security software, apps, POS, SNMP, and cloud services in the CDE.
• 2.2.3 - One primary function per component, or isolate differing security levels, or secure everything to the highest need.
• 2.2.4-2.2.5 - Only necessary services/protocols/daemons; document business justification and extra security for any insecure services that remain.
• 2.2.6 - System security parameters configured to prevent misuse.
• 2.2.7 - All non-console administrative access encrypted with strong cryptography (includes browser UIs and APIs).
• 2.3.1-2.3.2 - Change wireless vendor defaults (keys, AP passwords, SNMP, etc.); change wireless encryption keys when staff with key knowledge leave or keys are compromised.

CIS Benchmarks Mapping

CIS Benchmarks are a practical industry-accepted hardening baseline for 2.2.1. CyberSilo’s canonical CIS-for-PCI guide is Using CIS Benchmarks to Achieve PCI DSS Compliance Faster.

How CyberSilo Helps

• CIS Benchmarking Tool - continuous hardening evidence for Requirement 2
• Compliance Standards Automation - link baselines to QSA artefact packs

Frequently Asked Questions

Do vendor defaults in SaaS or cloud consoles count?

Yes. Requirement 2.2.2 applicability covers vendor default accounts and passwords across OS, security software, apps, POS, SNMP, and cloud subscription services that are part of the CDE.

How does Requirement 2 relate to CIS Benchmarks?

2.2.1 expects configuration standards consistent with industry-accepted hardening or vendor recommendations. CIS Benchmarks are a common way to evidence that baseline - see CyberSilo’s CIS-for-PCI guide.

Is wireless always in scope for 2.3?

2.3 applies to wireless environments connected to the CDE or transmitting account data - change vendor defaults (2.3.1) and manage key changes (2.3.2).

Related PCI Resources

PCI DSS hub · PCI DSS v4.0.1: What Changed · USA v4.0.1 services