PCI SSCPCI DSSSecurity PoliciesEASYFree question
What data classification requirement exists in PCI DSS security policies?
- A.A data retention policy must define a deletion date for cardholder records held in the payment application database or its backup archives
- B.A data labeling policy must print a confidential marking on each card receipt before it leaves the merchant location for the acquirer's archive
- C.A data ownership policy must name the acquirer the custodian of cardholder data stored in the merchant payment gateway database cluster
- D.A data classification policy must categorize data by sensitivity level to ensure cardholder data receives appropriate protection
Why D is correct
Data classification policies categorize data by sensitivity, ensuring cardholder data is identified and protected at the appropriate level throughout its lifecycle.
Know someone studying for PCI DSS? Send them this one.