DSS Compliance & Standards Flashcards

Which SAQ type fits a card-not-present merchant that has fully outsourced all cardholder data functions to PCI DSS-compliant third parties and keeps no electronic CHD?

Answer: SAQ A

SAQ A is for card-not-present merchants whose cardholder data functions are entirely outsourced.

A merchant uses only a PCI-listed P2PE solution's terminals and stores no cardholder data electronically. Which SAQ applies?

Answer: SAQ P2PE

SAQ P2PE is designed for merchants using only hardware payment terminals within a PCI-listed P2PE solution.

Under card brand programs, which merchant level typically applies to those processing over 6 million Visa transactions annually?

Answer: Level 1

Level 1 merchants exceed 6 million transactions per year and generally require an annual ROC.

Who may perform the assessment that produces a Report on Compliance (ROC)?

Answer: A QSA company or a qualified Internal Security Assessor

A ROC is completed by a QSA or, with acquirer/brand approval, an ISA.

What is the primary purpose of the Attestation of Compliance (AOC)?

Answer: To declare the entity's PCI DSS assessment results and compliance status

The AOC is a signed declaration summarizing the assessment results and compliance status.

How is the cardholder data environment (CDE) best defined?

Answer: All people, processes, and technology that store, process, or transmit CHD or SAD

The CDE includes the components that handle CHD/SAD plus anything that could impact their security.

What must a compensating control do to be acceptable?

Answer: Meet the intent and rigor of the original requirement and go above and beyond other controls

Compensating controls must satisfy the original intent and rigor and be 'above and beyond' existing controls.