What does PCI DSS require regarding risk assessments?

• A.A targeted risk analysis must be documented for each control performed at a defined frequency, and the analysis must be approved by executive management and reviewed by the QSA
• B.A formal risk assessment must be performed at least annually and upon significant changes to identify threats, vulnerabilities, and their potential impact on the CDE
• C.A vulnerability scan must be run each quarter by an ASV, with passing reports submitted to the acquirer and card brands
• D.A penetration test must be completed each year, and it replaces the need for a formal risk assessment of the CDE