PCI SSCPCI DSSSecurity PolicyEASYFree question
What is the purpose of a risk assessment under PCI DSS Requirement 12?
- A.To calculate the cost of PCI DSS compliance, on the basis that a targeted risk analysis may be performed once and never revisited for outsourced payment pages
- B.To assess employee job satisfaction, because the standard requires a risk assessment methodology drawn from a single named framework for tokenized data stores
- C.To evaluate vendor pricing for security tools, whose PCI DSS compliance status Requirement 12.8.4 obliges customers to monitor at least once every twelve months
- D.To identify threats, vulnerabilities, and the resulting risk to the organization's cardholder data environment so that appropriate controls can be implemented
Why D is correct
Risk assessments identify and evaluate threats and vulnerabilities to the CDE, enabling the organization to prioritize and implement appropriate security controls to mitigate identified risks.
Know someone studying for PCI DSS? Send them this one.