<font size=2 face="sans-serif">IBM BigFix Compliance PCI Add-on<br>Security Configuration Management (SCM)</font><p><p><font size=2 face="sans-serif">The IBM BigFix Compliance team has updated
the content for the Payment Card Industry Data Security Standard (PCI DSS)
checklist for Windows 2008, Windows 2012, and Windows 7. See details below.</font><p><p><font size=2 face="sans-serif"><b>Updated Site:</b><br>PCI DSS Checklist for Windows 7, version 5<br>PCI DSS Checklist for Windows 2012, version 7<br>PCI DSS Checklist for Windows 2008, version 7</font><p><font size=2 face="sans-serif"><i>*The site version is provided for
air-gap customers.</i></font><p><p><font size=2 face="sans-serif"><b>Changelist:</b></font><p><font size=2 face="sans-serif">For Windows 7:</font><ul><li><font size=2 face="sans-serif">The following checks are updated to
resolve APAR IV85006 - Long Evaluation Cycle Time:
</font><ul><li><font size=2 face="sans-serif"><i>“Verify that Administrator account
is renamed on the system”</i> (pcidss-2.1.b_1)</font><li><font size=2 face="sans-serif"><i>“Verify that Guest account is renamed
on the system” </i>(pcidss-2.1.b_2)</font><li><font size=2 face="sans-serif"><i>“Verify that Administrator account
on the system is set to Disabled”</i> (pcidss-2.1.b_3) </font><li><font size=2 face="sans-serif"><i>“Verify that Guest account on the
system is set to Disabled”</i> (pcidss-2.1.b_4)</font></ul><li><font size=2 face="sans-serif">The check named <i>“Verify that "Interactive
Logon: Do not require CTRL+ALT+DEL" is set to Disabled”</i> (pcidss-8.2_0.5)
is updated due to the incorrect desired value.</font><li><font size=2 face="sans-serif">The source ID for the following checks
are renumbered:</font><ul><li><font size=2 face="sans-serif"><i>“Verify that "Local Policy:
Debug programs" is set to Administrators” </i></font><p><font size=2 face="sans-serif">Source ID pcidss-7.2.3_5 is updated to
pcidss-7.2.2_59.</font><li><font size=2 face="sans-serif"><i>“Verify that "Local Policy:
Deny log on locally" is set to Guests” </i></font><p><font size=2 face="sans-serif">Source ID pcidss-7.2.3_6 is updated to
pcidss-7.2.2_60.</font></ul></ul><font size=2 face="sans-serif">For Windows
2012:</font><ul><li><font size=2 face="sans-serif">The following checks are updated to
resolve APAR IV85006 - Long Evaluation Cycle Time:
</font><ul><li><font size=2 face="sans-serif"><i>“Verify that Administrator account
is renamed on the system” (pcidss-2.1.b_1)</i></font><li><font size=2 face="sans-serif"><i>“Verify that Guest account is renamed
on the system” (pcidss-2.1.b_2)</i></font><li><font size=2 face="sans-serif"><i>“Verify that Administrator account
on the system is set to Disabled” (pcidss-2.1.b_3) </i></font><li><font size=2 face="sans-serif"><i>“Verify that Guest account on the
system is set to Disabled” (pcidss-2.1.b_4)</i></font></ul><li><font size=2 face="sans-serif">The check named <i>“Verify that "Audit
Policy: DS Access: Directory Service Changes" for Enterprise Domain
Controller is set to Success”</i> (pcidss-10.2.2_6.1) is removed because
Domain Controller is not supported.</font><li><font size=2 face="sans-serif">Relevance of <i>"Verify that remote-login
command should be restricted through non console access for IIS HTTP Server"</i>(pcidss-2.3.b.3) is updated with proper version of IIS.</font></ul><font size=2 face="sans-serif">For
Windows 2008:</font><ul><li><font size=2 face="sans-serif">The following checks are updated to
resolve APAR IV85006 - Long Evaluation Cycle Time:
</font><ul><li><font size=2 face="sans-serif"><i>“Verify that Administrator account
is renamed on the system” (pcidss-2.1.b_1)</i></font><li><font size=2 face="sans-serif"><i>“Verify that Guest account is renamed
on the system” (pcidss-2.1.b_2)</i></font></ul></ul><p><font size=2 face="sans-serif"><b>Actions to Take:</b></font><ul><li><font size=2 face="sans-serif">If you use custom sites, update your
custom sites accordingly to use the latest content. You can synchronize
your content by using the Synchronize Custom Checks wizard. For more information,
see </font><a href=https://ibm.biz/Bd4LBt><font size=2 color=#0082bf face="sans-serif"><u>https://ibm.biz/Bd4LBt</u></font></a><font size=2 face="sans-serif">.</font><li><font size=2 face="sans-serif">If you have not subscribed to the site
above, you can use the License Overview dashboard to enable and gather
the sites. Note that you must be entitled to the new content and you are
using IBM BigFix version 9.0 and later.</font><li><font size=2 face="sans-serif">If you were involved in the Early Access
Program for IBM BigFix Compliance PCI Add-on, unsubscribe from the beta
sites to avoid any conflicting issues with the production sites. If you
do not unsubscribe from the beta sites, the content in the production sites
will fail.</font></ul><br><font size=2 face="sans-serif"><b>Documentation Resources:</b><br>To know more about IBM BigFix Compliance PCI Add-on, see the </font><a href=https://ibm.biz/Bd4Vic><font size=2 color=#0082bf face="sans-serif"><u>IBM
BigFix Compliance PCI Add-on User's Guide</u></font></a><font size=2 face="sans-serif">.
</font><br><br><font size=2 face="sans-serif">We hope you find this latest release
of SCM content useful and effective. Thank you!</font><p><p><font size=2 face="sans-serif"><i> -- The IBM BigFix Compliance
team</i></font><BR>