Leadership & Team Management Flashcards

When an entity chooses its own frequency for certain periodic tasks in PCI DSS v4.0, what must support that frequency?

Answer: A targeted risk analysis

Requirement 12.3.1 requires a documented targeted risk analysis to justify flexible frequencies.

What must security awareness training include per Requirement 12.6.3.1?

Answer: Threats such as phishing and social engineering

Training must cover phishing and related attacks and social engineering.

How often must service providers review that personnel are performing their security tasks (Requirement 12.4.2)?

Answer: At least once every three months

Service providers perform quarterly reviews to confirm tasks are performed per policy.

How often must hardware and software technologies in use be reviewed to confirm they remain supported?

Answer: At least once every 12 months

Requirement 12.3.4 requires annual review of technologies, including vendor support status.

What must a TPSP provide to its customers under Requirement 12.9.1?

Answer: A written acknowledgment of responsibility for account data security

TPSPs must acknowledge in writing their responsibility for the security of account data they handle.

What must be true of personnel with incident response responsibilities?

Answer: They must be appropriately and periodically trained

Requirement 12.10.4 requires appropriate, periodic training of incident response personnel.

What does Requirement 12.5.1 require regarding system components?

Answer: An inventory of in-scope system components kept current

An inventory of in-scope system components with business use must be maintained.