DSS Compliance & Standards Flashcards

According to Req. 3.3.1, what must happen to sensitive authentication data (SAD) after authorization?

Answer: It must not be retained, even if encrypted

SAD, including full track data, CVV2, and PIN blocks, must not be stored after authorization.

When PAN is displayed, what is the maximum that may be shown under Req. 3.4.1 for a business need?

Answer: The BIN and the last four digits

Displayed PAN must be masked so at most the BIN and last four digits are visible.

Requirement 4.2.1 requires which protection for PAN transmitted over open, public networks?

Answer: Strong cryptography and security protocols

Strong cryptography and trusted keys/certificates must protect PAN in transit over open public networks.

What is the minimum audit log retention under Req. 10.5.1?

Answer: 12 months, with the most recent 3 months immediately available

Retain audit log history for at least 12 months, with the latest three months immediately available.

How often must internal vulnerability scans be performed under Req. 11.3.1?

Answer: At least once every three months

Internal scans are required at least once every three months and after significant change rescans as needed.

Under Req. 11.4.2, how often must internal penetration testing be performed?

Answer: At least once every 12 months and after significant changes

Internal pen tests are required at least annually and after significant infrastructure or application changes.

What is the minimum password length for systems under Req. 8.3.6 (when passwords are used) in PCI DSS v4.0?

Answer: 12 characters

v4.0 raised the minimum password length from 7 to 12 characters (or 8 if the system doesn't support 12).