PCI SSCPCI DSSSecurity PolicyEASYFree question
What does PCI DSS Requirement 12 mandate regarding information security policies?
- A.A written information security policy must be approved by the QSA, signed by every employee, and filed with the acquirer ahead of the assessment
- B.A comprehensive information security policy must be established, published, maintained, and disseminated to all relevant personnel
- C.Security policies must be drafted by the QSA, approved by the acquirer, and issued only to the IT department
- D.A policy statement must be published on the website, signed by all directors, and refreshed after each audit
Why B is correct
PCI DSS Requirement 12 requires maintaining a formal information security policy that addresses all PCI DSS requirements and is distributed to all relevant personnel.
Know someone studying for PCI DSS? Send them this one.