PCI DSS 4.0
Req 2: Secure Configurations

PCI DSS 4.0 2.3.1: 2.3.1 Wireless vendor defaults changed or confirmed secure

For wireless environments that connect to the CDE or carry account data, every wireless vendor default must be changed at installation or confirmed as secure, including but not limited to: (a) default wireless encryption keys; (b) passwords on wireless access points; (c) SNMP defaults; and (d) any further wireless vendor default that affects security. Applicability: the scope explicitly includes the same four categories and is not limited to them. Customized approach objective: default vendor passwords or out-of-the-box settings cannot be used to get into wireless networks.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 23 controls across 13 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27001:2022 · 3 controls

  • 5.17 Authentication information
  • 8.20 Networks security
  • 8.9 Configuration management

SOC 2 · 3 controls

  • SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
  • SOC2-CC6.1 CC6.1 Logical access security over protected information assets
  • SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

  • ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services
  • ANSSI-HYG-20 Secure Wi-Fi Access Networks and Separate Usage

CMMC 2.0 · 2 controls

FedRAMP High · 2 controls

  • AC-18(1) Authentication and Encryption
  • AC-2 Account Management

FedRAMP Moderate · 2 controls

  • AC-18(1) Authentication and Encryption
  • AC-2 Account Management

ISO 27002:2022 · 2 controls

  • 5.17 Authentication information
  • 8.9 Configuration management

NIST SP 800-161 Rev 1 · 2 controls

CIS Controls v8 · 1 control

  • CIS-4.7 Manage Default Accounts on Enterprise Assets and Software

NIST Cybersecurity Framework 2.0 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-53 Rev 5 · 1 control

UK Cyber Essentials · 1 control

  • CE-SC.2 Change Default Passwords on Devices and Software

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Req 2: Secure Configurations

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 2.3.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202249.6% covered · 141 gapsIf you hold FedRAMP Moderate49.3% covered · 142 gapsIf you hold NIST SP 800-53 Rev 547.5% covered · 147 gapsIf you hold ISO 27002:202243.2% covered · 159 gapsIf you hold CIS Controls v838.2% covered · 173 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.136.4% covered · 178 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 23 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PCI DSS 4.0 controls