PCI SSCPCI DSSSecurity PolicyEASYFree question
What is the purpose of a risk assessment under PCI DSS Requirement 12?
- A.To estimate the annual loss expectancy of each payment system, so that the finance team can set the cyber insurance premium and the cover limit negotiated with the acquirer
- B.To document the firewall rule base, router standards, and approved ports so that the QSA can sample them during the assessment of Requirement 1 and Requirement 2 controls
- C.To satisfy the acquirer's reporting calendar, since the risk assessment is the artifact submitted with the quarterly ASV scan results, the attestation of scan compliance, and the penetration test report
- D.To identify threats, vulnerabilities, and the resulting risk to the organization's cardholder data environment so that appropriate controls can be implemented
Why D is correct
Risk assessments identify and evaluate threats and vulnerabilities to the CDE, enabling the organization to prioritize and implement appropriate security controls to mitigate identified risks.
Know someone studying for PCI DSS? Send them this one.