DSS Compliance & Standards Flashcards

Which statement about ASV scans is correct?

Answer: A passing scan has no vulnerabilities rated CVSS 4.0 or higher

A passing ASV scan requires no vulnerabilities scored 4.0 or higher on the CVSS scale.

What is the PCI Security Standards Council's role in compliance?

Answer: It develops and manages standards but does not enforce compliance

The PCI SSC maintains the standards; enforcement is by payment brands and acquirers.

Who typically enforces PCI DSS compliance and levies non-compliance penalties on merchants?

Answer: Acquirers and payment brands

Payment brands and acquiring banks set validation requirements and penalties.

Which program replaced PA-DSS for payment software?

Answer: PCI Software Security Framework

The PCI Software Security Framework (Secure Software and Secure SLC standards) superseded PA-DSS.

What do Requirements 12.8.5 and 12.9.2 address regarding third-party service providers (TPSPs)?

Answer: Documenting which PCI DSS requirements are managed by each party, with shared responsibility information

Entities and TPSPs must clarify which requirements each manages and share responsibility information.

How often must security awareness training be completed under Req. 12.6.3?

Answer: Upon hire and at least once every 12 months

Personnel need awareness training upon hire and at least annually thereafter.

Per Req. 12.10.2, how often must the incident response plan be reviewed and tested?

Answer: At least once every 12 months

The incident response plan must be reviewed and tested at least every 12 months.