DSS Compliance & Standards Flashcards

Under PCI DSS v4.0, how often must the scope of PCI DSS be documented and confirmed (Req. 12.5.2)?

Answer: At least once every 12 months and upon significant change

Scope must be documented and confirmed at least every 12 months and after significant change.

When did the future-dated requirements of PCI DSS v4.0 become mandatory?

Answer: March 31, 2025

Future-dated v4.0 requirements became effective March 31, 2025, when v3.2.1 had already been retired.

Which entities generally cannot use the customized approach when completing a Self-Assessment Questionnaire?

Answer: Entities completing an SAQ

The customized approach is not supported for SAQs; it requires a ROC-style assessment.

PCI DSS v4.0 Requirement 6.4.3 requires what for scripts on payment pages loaded in the consumer's browser?

Answer: Scripts must be managed with authorization, integrity assurance, and an inventory with justification

Req. 6.4.3 requires each script be authorized, integrity-checked, and inventoried with business justification.

Requirement 11.6.1 introduced in v4.0 addresses which risk?

Answer: Unauthorized changes to HTTP headers and payment page content via a change- and tamper-detection mechanism

11.6.1 requires detecting unauthorized modification of HTTP headers and payment page contents.

Under v4.0 Requirement 8.4.2, MFA is required for:

Answer: All access into the CDE

v4.0 extends MFA to all non-console access into the CDE, not just remote or administrative access.

What does a targeted risk analysis (Req. 12.3.1) permit an entity to do?

Answer: Define the frequency of certain periodic activities where the requirement allows flexibility

Targeted risk analyses let entities determine frequency of specific periodic controls when the requirement allows it.