What does PCI DSS require regarding incident response?

• A.An incident response plan must be created, maintained, and tested at least annually
• B.A written incident response plan must be filed with the acquirer, reviewed by counsel, and updated after each breach
• C.The acquirer's response team must be named in the plan, the call tree reviewed, and tests run once in three years
• D.Incident handling must be outsourced to a forensic firm, retained by contract, and drilled after each breach