PCI SSCPCI DSSVulnerability ManagementEASYFree question
What does PCI DSS require regarding software development?
- A.Software must be developed based on secure coding guidelines and industry best practices
- B.Software must be developed under a vendor-specific waterfall model and signed off by the acquirer
- C.Developers must be certified by the card brands and listed on a public register held by PCI SSC
- D.Source code must be escrowed with the acquirer and audited by the QSA
Why A is correct
PCI DSS Requirement 6 mandates that all software be developed according to secure coding guidelines such as OWASP, with security integrated throughout the development lifecycle.
Know someone studying for PCI DSS? Send them this one.