PCI SSCPCI DSSSecurity PoliciesEASYFree question
What is the PRIMARY purpose of a PCI-DSS information security policy?
- A.To establish the organization's commitment to protecting cardholder data and define the framework for all security activities
- B.To record the approved vendors for all payment terminals and define the escalation path for lost devices reported to the acquirer
- C.To list the audit findings of all business units and define the penalty schedule agreed between the merchant and the card brands
- D.To transfer liability for all breach costs to the acquirer and define the insurance coverage limits that the merchant must carry
Why A is correct
The information security policy establishes the organization's commitment to protecting cardholder data and provides the framework that guides all security-related activities and decisions.
Know someone studying for PCI DSS? Send them this one.