Leadership & Team Management Flashcards

What is the role of the PCI Security Standards Council?

Answer: It develops and manages the standards but does not enforce compliance

Enforcement is carried out by payment brands and acquirers.

Which merchants are generally classified as Visa Level 1?

Answer: Those processing over 6 million Visa transactions annually

Visa Level 1 merchants process more than 6 million Visa transactions per year.

Who typically completes a Report on Compliance (ROC)?

Answer: A QSA or qualified internal assessor (ISA)

A ROC is completed by a QSA or an ISA, depending on requirements.

What distinguishes the customized approach in PCI DSS v4.0?

Answer: It lets entities meet an objective with alternative controls supported by targeted risk analysis

The customized approach meets the stated objective with documented, assessor-validated controls.

What must a compensating control accomplish?

Answer: Provide a similar level of defense and go above other requirements

Compensating controls must meet the intent and rigor of the original requirement and be documented.

Which role leads internal PCI efforts and is certified by the PCI SSC through a sponsor company program?

Answer: ISA (Internal Security Assessor)

The ISA program trains employees of an organization to perform internal assessments.

What does an Approved Scanning Vendor (ASV) perform?

Answer: External vulnerability scans at least quarterly

ASVs perform quarterly external vulnerability scans required by Requirement 11.3.2.