Duo Access Gateway

Security Policies and Procedures for Managing Vendor Defaults (2.5)

User Authentication Management (8.2)

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Unique User IDs (8.1.1)

MFA for non-console access to CDE (8.3.1)

Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

Restricting PAN (3.3)

Security Policies and Operational Procedures (3.7)

Removing Unnecessary Functionality (2.2.5)

Revoking Access for Terminated Users (8.1.3)

Enabling Only Necessary Services (2.2.2)

Removing/disabling Inactive User Accounts (8.1.4)

Managing PAN Data Storage (3.4)

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

7.2 Physical entry - Secure areas shall be protected by appropriate entry controls and access points.

7.4 Physical security monitoring - Premises shall be continuously monitored for unauthorized physical access.

7.5 Protecting against physical and environmental threats - Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.