Do you require remote management of the system?
Explanation
Remote administration is the subject: whether running your system depends on managing, configuring, or maintaining it from somewhere other than where the hardware physically sits.
In a security assessment context, this question is important because remote management introduces additional security risks. Remote management tools and protocols (like SSH, RDP, VNC, or web-based admin panels) create potential entry points for attackers if not properly secured. Under PCI DSS specifically, remote access to systems that process, store, or transmit cardholder data requires strong security controls including multi-factor authentication, encryption, and detailed logging.
When answering this question, you should be clear about whether remote management is required for your system's operation. If it is required, you should be prepared to explain the security controls implemented to protect these remote management channels. If remote management is not required, this generally represents a smaller attack surface and potentially lower risk profile for your system.
Example Responses
Example Response 1
Yes, our system requires remote management capabilities Our cloud-based SaaS platform is hosted in AWS data centers, and our operations team needs to remotely access and manage these systems To secure this remote access, we implement multiple security controls including: (1) All remote management sessions use encrypted protocols (SSH/TLS); (2) Multi-factor authentication is required for all administrative access; (3) Access is restricted to specific IP addresses via firewall rules; (4) All remote management sessions are logged and monitored for suspicious activity; and (5) We use a jump box architecture where administrators must first connect to a hardened bastion host before accessing production systems.
Example Response 2
No, our system does not require remote management Our application is deployed as an on-premises solution that is managed locally by the customer's IT staff All administrative functions are performed through a local console that requires physical access to the server System updates and patches are applied through a manual process that also requires physical access to the system This approach eliminates remote management attack vectors entirely.
Example Response 3
Yes, we do require remote management capabilities, but we have not yet implemented all the necessary security controls required by PCI DSS Currently, our administrators use RDP to access Windows servers, but we are still in the process of implementing multi-factor authentication for these connections Additionally, while we do log remote access attempts, we don't have a formal monitoring process in place to review these logs We recognize these gaps and have a remediation plan to address them within the next 90 days, including implementing a privileged access management solution and establishing a formal log review process.
Context
- Tab
- Case-Specific
- Category
- Payment Card Industry Data Security Standard (PCI DSS)
Related questions
- Do you have a current, executed within the past year, Attestation of Compliance (AoC) or Report on Compliance (RoC)?
- Is the application listed as an approved Payment Application Data Security Standard (PA-DSS) application?
- Does the system or solutions use a third party to collect, store, process, or transmit cardholder (payment/credit/debt card) data?
- Do your systems or solutions store, process, or transmit cardholder (payment/credit/debt card) data?
- Are you compliant with the Payment Card Industry Data Security Standard (PCI DSS)?
- Are you classified as a service provider?