PCI SSCPCI DSSSecurity PolicyEASYFree question
What is the purpose of a risk assessment under PCI DSS Requirement 12?
- A.To calculate the cost of PCI DSS compliance
- B.To evaluate vendor pricing for security tools
- C.To assess employee job satisfaction
- D.To identify threats, vulnerabilities, and the resulting risk to the organization's cardholder data environment so that appropriate controls can be implemented
Why D is correct
Risk assessments identify and evaluate threats and vulnerabilities to the CDE, enabling the organization to prioritize and implement appropriate security controls to mitigate identified risks.
Know someone studying for PCI DSS? Send them this one.