PCI SSCPCI DSSSecurity PolicyEASYFree question
Who must be made aware of an organization's information security policy under PCI DSS?
- A.All personnel, including employees, contractors, and third parties with access to the CDE
- B.Only security and compliance staff, including the CISO, the internal audit team, and the vendors that host payment pages
- C.All employees on the payroll, including managers and interns, with contractors excluded
- D.Only executive management and board members, including the CEO and the audit chair
Why A is correct
PCI DSS requires that the information security policy be disseminated to all relevant personnel, ensuring everyone with access to the CDE or cardholder data understands their security responsibilities.
Know someone studying for PCI DSS? Send them this one.