Implementation Checklist (Target (2014 breach context))

A practical rollout plan with measurable proof for payment-environment hardening and evidence-backed control operation.

0–30 days (stabilize + baseline)

• Inventory payment-path systems and segmentation boundaries
• Baselined firewall/POS boundary policies in controlled repository
• Establish approval workflow for high-risk payment-environment changes

Deliverables - Segment baseline package with owner attestations - Emergency change protocol for payment systems - Payment-path logging coverage report

30–60 days (control effectiveness)

• Enable drift detection for segmentation and boundary controls
• Perform least-privilege review for payment and admin roles
• Implement detections for anomalous payment-system access

Deliverables - Segmentation drift metrics and alerts - IAM review evidence for payment systems - Detection rules documented and validated

60–90 days (evidence readiness)

• Run 48-hour evidence-pack exercise for payment-security artifacts
• Introduce independent testing checkpoints for key controls
• Publish quarterly leadership reporting for payment risk posture

Deliverables - Evidence-pack checklist and artifact owners - Mock audit drill outcomes and remediation tasks - Quarterly payment-security governance report template

Ongoing metrics (prove it's real)

• % payment-boundary changes with approved PR/tickets
• Segmentation drift MTTR
• Privileged account exception count
• Critical payment log coverage %
• Closure time for high-risk payment findings