PCI SSCPCI DSSCompliance ReportingEASYFree question
How must compensating controls be documented in PCI DSS compliance reporting?
- A.Using the Targeted Risk Analysis template, detailing the threat, likelihood, impact rating, review frequency, and sign-off from the senior management team
- B.Using the Prioritized Approach spreadsheet, detailing the milestone, requirement number, completion date, owner, and written sign-off from the acquiring bank
- C.Using the Attestation of Compliance, detailing the constraint, scope, QSA name, and assessment dates
- D.Using the Compensating Controls Worksheet, detailing the constraint, objective, risk identified, controls in place, and validation of effectiveness
Why D is correct
Each compensating control requires a formal Compensating Controls Worksheet documenting the constraint, security objective, risk assessment, control details, and validation evidence.
Know someone studying for PCI DSS? Send them this one.