PCI SSCPCI DSSSecurity PoliciesEASYFree question
What does PCI DSS require regarding service provider management?
- A.Organizations must maintain a list of service providers, have written agreements defining security responsibilities, and monitor service provider PCI DSS compliance status
- B.Organizations must keep a list of service providers, obtain a QSA report from each one, and replace any provider that fails an assessment
- C.Organizations must grant service providers read access to logs, document the contacts in a policy, and renew the agreements on a three year cycle
- D.Organizations must name an executive owner for each service provider, record the service in the scope document, and exempt providers certified by a card brand
Why A is correct
Organizations must list service providers, maintain written agreements defining security responsibilities, and monitor their ongoing PCI DSS compliance.
Know someone studying for PCI DSS? Send them this one.