PCI SSCPCI DSSSecurity PolicyEASYFree question
PCI DSS requires an incident response plan. What is its PRIMARY purpose?
- A.To define the password length and lockout settings that apply to user accounts on payment servers
- B.To document the quarterly vulnerability scanning schedule and the approved scanning vendor engagement terms for the entity
- C.To provide a structured approach for responding to and managing security incidents and suspected breaches involving cardholder data
- D.To record the network diagram and the data flow diagram for the cardholder data environment each year
Why C is correct
An incident response plan ensures the organization can respond quickly and effectively to security incidents, minimizing damage, preserving evidence, and meeting notification obligations.
Know someone studying for PCI DSS? Send them this one.