PCI SSCPCI DSSSecurity PoliciesEASYFree question
What is the PRIMARY purpose of an information security policy in PCI DSS?
- A.To define the technical configuration standards for firewalls and routers used across the cardholder data environment
- B.To assign liability for card brand fines and set the penalty schedule for personnel who violate the rules
- C.To establish the organization's commitment to information security and provide direction for protecting cardholder data across the entire organization
- D.To document the quarterly vulnerability scan results and the remediation dates agreed with the approved scanning vendor
Why C is correct
The security policy establishes the organization's security commitment and provides direction for all personnel on protecting cardholder data.
Know someone studying for PCI DSS? Send them this one.