What it asks for. Organisations must configure and manage system components securely. This includes changing vendor default passwords and settings, removing unnecessary functions, and applying documented configuration standards to every in-scope system, including wireless environments connected to cardholder data.
In practice. Configuration standards based on recognised hardening guidance exist for each system type and are applied when systems are built or changed. Default accounts are disabled or have their passwords changed, unnecessary services and protocols are removed, insecure ones are justified and secured, and each server function is separated where appropriate. Administrative access uses encrypted channels. An assessor will expect the configuration standards, evidence they are applied, scan or configuration review output, and documented roles for managing them.
Common gaps. Typical failures are defaults left on network devices, appliances and cloud services, and standards that are written but not checked against the live estate. Wireless vendor defaults and legacy insecure protocols are often missed.