PCI SSCPCI DSSSecurity PoliciesEASYFree question
What does PCI DSS require regarding risk assessments?
- A.Only during the initial PCI DSS assessment
- B.A formal risk assessment must be performed at least annually and upon significant changes to identify threats, vulnerabilities, and their potential impact on the CDE
- C.Only assess financial risks, which the standard requires to be re-issued only when the assessor changes
- D.Risk assessments are optional
Why B is correct
PCI DSS requires an annual risk assessment (and after significant changes) to identify, prioritize, and address threats and vulnerabilities to the CDE.
Know someone studying for PCI DSS? Send them this one.