PCI SSCPCI DSSIncident ResponseEASYFree question
Which PCI DSS requirement mandates an incident response plan?
- A.Requirement 10 requires organizations to record user access to system components and review the audit logs daily to detect suspicious activity
- B.Requirement 11 requires organizations to test security systems and processes with scans and penetration tests
- C.Requirement 12.10 requires organizations to implement an incident response plan and be prepared to respond immediately to a system breach
- D.Requirement 12.8 requires organizations to manage service providers and keep a list of those with access
Why C is correct
PCI DSS Requirement 12.10 specifically requires implementation of an incident response plan for immediate response to system breaches.
Know someone studying for PCI DSS? Send them this one.