Question 1

What evidence do auditors ask for on 2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,?

Accepted Answer

Build checklist requiring default cred change; Sample evidence on deployed systems; Account inventory showing disabled defaults; Scanner results confirming no default creds; Exceptions register with controls.

Question 2

Can 2.2.2 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on 2.2.2?

Accepted Answer

Defaults left on appliances

`2.2.2` Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet