What does PCI DSS require regarding employee background checks?
- A.Credit checks must be repeated each year for personnel in the finance department, and the results must be filed with the acquirer before the annual assessment of the CDE begins
- B.Background checks must be completed within ninety days after hire for personnel with CDE access, and the results are held by the acquirer for ten years in its audit evidence archive
- C.Background checks must be performed for personnel who have access to the CDE, cardholder data, or sensitive areas, prior to hire and within local legal constraints
- D.Screening is required for executive management and the security team, with local law overriding the requirement entirely, and results go to the QSA for review in the annual report on compliance
Why C is correct
Background checks are required for personnel with access to the CDE or cardholder data, performed prior to hire and consistent with local laws.
Know someone studying for PCI DSS? Send them this one.