PCI DSS Requirements & Implementation Flashcards

Under PCI DSS v4.x, what is the minimum password length when passwords are used as an authentication factor and the system supports it?

Answer: 12 characters

Requirement 8.3.6 raised the minimum password length to 12 characters (8 only if the system does not support 12).

How long must audit log history be retained, and how much must be immediately available for analysis?

Answer: 12 months retained, 3 months immediately available

Requirement 10.5.1 requires at least 12 months of audit log history with the most recent 3 months immediately available.

Which of the following sensitive authentication data (SAD) elements may be stored after authorization if the issuer-support business justification exists and it is encrypted?

Answer: Only issuers or companies supporting issuing services may store SAD

Requirement 3.3.1.x allows SAD storage after authorization only for issuers and issuer-support entities with a legitimate business need and secure storage.

What is the maximum number of PAN digits that may be displayed when a PAN is masked for personnel with a legitimate business need?

Answer: First 6 and last 4 (BIN and last four)

Requirement 3.4.1 permits showing at most the BIN and last four digits (with 8-digit BIN allowances for longer PANs).

Which PCI DSS requirement primarily addresses restricting access to system components and cardholder data by business need to know?

Answer: Requirement 7

Requirement 7 covers restricting access to system components and cardholder data by business need to know.

How often must user accounts and related access privileges be reviewed under Requirement 7.2.4?

Answer: At least once every six months

Requirement 7.2.4 requires all user accounts and access privileges to be reviewed at least once every six months.

A merchant wants to use an in-scope system's vendor-default administrator account. What does Requirement 2.2.2 expect?

Answer: Change default passwords before installation or remove/disable the default accounts

Requirement 2.2.2 requires vendor default accounts to be managed: changed, removed or disabled, and default passwords changed.