Which requirement states that vendor-supplied defaults for system passwords and other security parameters must not be used?

Which requirement states that vendor-supplied defaults for system passwords and other security parameters must not be used?

• A. Encrypt transmission of cardholder data across open, public networks
• B. Do not use vendor-supplied defaults for system passwords and other security parameters
• C. Protect stored cardholder data
• D. Restrict access to cardholder data by business need to know

Answer: (B)

Not using vendor-supplied defaults for system passwords and other security parameters is about configuration hardening. Vendor defaults are widely known and often left in place, creating an easy target for attackers. By changing default passwords, usernames, and other settings to unique, strong values and disabling or removing unused default accounts, you remove common, easily exploitable entry points. This practice directly reduces the risk of unauthorized access and is a stated PCI DSS requirement focused on ensuring systems aren’t shipped with easy-to-guess credentials or insecure defaults. Other options address protecting data in transit, protecting stored data, or controlling access, which are important controls but target different risks. They don’t specifically address the vulnerability posed by leaving vendor defaults in place.

Not using vendor-supplied defaults for system passwords and other security parameters is about configuration hardening. Vendor defaults are widely known and often left in place, creating an easy target for attackers. By changing default passwords, usernames, and other settings to unique, strong values and disabling or removing unused default accounts, you remove common, easily exploitable entry points. This practice directly reduces the risk of unauthorized access and is a stated PCI DSS requirement focused on ensuring systems aren’t shipped with easy-to-guess credentials or insecure defaults.

Other options address protecting data in transit, protecting stored data, or controlling access, which are important controls but target different risks. They don’t specifically address the vulnerability posed by leaving vendor defaults in place.