PCI Security Standards Council · Card issuing and acquiring; annual QSA assessment

PCI DSS evidence pack

18 controls map to PCI DSS v4.0.1. Draft each narrative from live evidence, have a named reviewer approve it, then export the binder the assessor receives.

0 of 18 approved · 0 drafted

This pack reports what was observed in Northgate Union Bank's own systems. It does not state that the bank is compliant: the examiner concludes. Every sentence carries a citation you can hover or click.

GV-01Information security program is Board-approved

PCI DSS12.1.1 · Security policy maintained

EvidencedNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

GV-03Material outsourcing and cloud providers are assessed

PCI DSS12.8.4 · Service providers monitored

EvidencedNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

ID-01Asset inventory matches the network

PCI DSS12.5.1 · Inventory of system components

PartialNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

ID-02Vulnerabilities are fixed within the bank's standard

PCI DSS6.3.3 · Critical patches installedPCI DSS11.3.1 · Internal scans every quarter

PartialNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

ID-03External penetration test every year

PCI DSS11.4.3 · External penetration test

EvidencedNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

ID-05Cyber risk assessment is current

PCI DSS12.3.1 · Targeted risk analysis

EvidencedNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

PR-01Privileged accounts are vaulted and attributable

PCI DSS7.2.5 · System and application accounts

GapNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

PR-02Phishing-resistant MFA for privileged access

PCI DSS8.4.1 · MFA for administrative CDE access

PartialNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

PR-04Access is recertified to least privilege

PCI DSS7.2.4 · Accounts reviewed every six months

PartialNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

PR-05Data at rest is encrypted

PCI DSS3.5.1 · Card numbers unreadable

EvidencedNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

PR-06Cardholder and SWIFT zones are segmented

PCI DSS1.3.1 · Inbound traffic to the CDE restricted

GapNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

PR-07Security changes follow approved change records

PCI DSS6.5.1 · Changes follow change control

GapNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

PR-08Endpoint protection runs on every host

PCI DSS5.2.1 · Anti-malware deployed

PartialNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

PR-10Staff and customers are trained to spot scams

PCI DSS12.6.1 · Security awareness program

EvidencedNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

PR-11Data in transit is encrypted

PCI DSS4.2.1 · Strong cryptography in transmission

EvidencedNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

DE-01Security logs are kept for the required period

PCI DSS10.5.1 · Audit log history kept 12 months

GapNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

DE-04Daily log review is performed and recorded

PCI DSS10.4.1 · Audit logs reviewed daily

PartialNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.

RS-01Incidents reach BSP within 2 hours

PCI DSS12.10.1 · Incident response plan

EvidencedNot drafted

Not drafted yet. The draft is written from this control's evidence only, then checked claim by claim.