PCI SSCPCI DSSSecurity PoliciesEASYFree question
What must be defined in security policies regarding roles and responsibilities?
- A.Information security responsibilities must be assigned to the CISO alone for all requirements, and executive management delegates the PCI DSS program to the acquirer
- B.Roles must be defined for all security staff, and the QSA assigns an owner to each requirement during the assessment
- C.Information security roles and responsibilities must be clearly defined and assigned for all personnel, including specific ownership of PCI DSS requirements
- D.A responsibilities matrix must cover all system administrators, and each owner is named in the report on compliance
Why C is correct
Security policies must clearly define and assign roles and responsibilities for information security across all personnel and PCI DSS requirements.
Know someone studying for PCI DSS? Send them this one.