PCI SSCPCI DSSIncident ResponseEASYFree question
What must organizations do when they suspect a cardholder data breach?
- A.Notify the issuing banks and the PCI SSC within the same business day and wait for the council to open its own investigation of the merchant
- B.Wait until the PFI report is finished and then notify the acquiring bank with the confirmed count of compromised accounts
- C.Immediately notify the acquiring bank and relevant payment card brands per their specific notification programs and timelines
- D.Notify the approved scanning vendor and the qualified security assessor and let them relay the breach to the card brands
Why C is correct
Organizations must immediately notify their acquirer and relevant card brands upon suspecting a breach, following each brand's notification requirements.
Know someone studying for PCI DSS? Send them this one.