PCI SSCPCI DSSVulnerability MgmtEASYFree question
What does PCI DSS require for software development?
- A.Software must be developed against the vendor's published release notes and the acquirer's coding checklist, with a penetration test completed after each production deployment
- B.Software must be written by a certified assessor firm and reviewed by the QSA, with security checks added after go-live
- C.Software must be developed on isolated test hosts and signed by the QSA, with security requirements added after release
- D.Software must be developed based on industry best practices and secure coding guidelines, with security integrated throughout the development lifecycle
Why D is correct
PCI DSS requires software development to follow industry best practices and secure coding guidelines throughout the entire development lifecycle.
Know someone studying for PCI DSS? Send them this one.