Sources of industry-accepted system hardening
standards may include, but are not limited to:
● Center for Internet Security (CIS)
● International Organization for
Standardization (ISO)
● SysAdmin Audit Network Security (SANS)
Institute
● National Institute of Standards Technology
(NIST).
2.2.1 Implement only one primary function
per server to prevent functions that require
different security levels from coexisting on
the same server. (For example, web servers,
database servers, and DNS should be
implemented on separate servers.)
Note:
Where virtualization technologies are in
use, implement only one primary function per
virtual system component.
The Toast POS workstations are to
provide payment functionality only.
2.2.2 Enable only necessary services,
protocols, daemons, etc., as required for the
function of the system.
The Toast POS solution is delivered with
all unnecessary services, protocols,
daemons, etc. disabled.
2.2.3 Implement additional security features
for any required services, protocols, or
daemons that are considered to be insecure.
Note:
Where SSL/early TLS is used, the
requirements in Appendix A2 must be
completed.
The Toast POS solution is delivered with
no unsecure services enabled. The
solution only supports TLS 1.2
connectivity and all cardholder data is
encrypted prior to transmission by the
hardware or application.
2.2.4 Configure system security parameters
to prevent misuse.
The Toast POS solution is delivered with
security parameters enabled to prevent
misuse.
2.2.5 Remove all unnecessary functionality,
such as scripts, drivers, features, subsystems,
file systems, and unnecessary web servers.
The Toast POS solution is delivered with
all unnecessary functionality, such as
scripts, drivers, features, subsystems, file
systems, and unnecessary web servers
removed.
2.3 Encrypt all non-console administrative
access using strong cryptography.
Note:
Where SSL/early TLS is used, the
requirements in Appendix A2 must be
completed.
The Toast POS solution as delivered only
supports console-based access.
2.4 Maintain an inventory of system
components that are in scope for PCI DSS.
You are responsible for
maintaining an inventory of
system components that are
in scope for PCI DSS.
2.5 Ensure that security policies and
operational procedures for managing vendor
defaults and other security parameters are
You are responsible for
maintaining appropriate
policies and processes.
PCI Instruction Guide
© Toast 2018
Page 23 of 44
To Next Page
