Incident Response & Data Breach Management Flashcards

What must a PCI-compliant incident response plan include?

Answer: Roles and responsibilities, communication procedures, containment strategies, forensic investigation steps, and recovery procedures

PCI DSS requires a documented incident response plan covering detection, containment, eradication, recovery, notification procedures, root cause analysis, and plan testing.

What is the first priority during a payment data breach?

Answer: Containing the breach to prevent further data loss while preserving evidence

Containment stops the bleeding by isolating affected systems, blocking attack vectors, and preserving forensic evidence, while maintaining business continuity where possible.

What is a PCI Forensic Investigator (PFI)?

Answer: A PCI Council-approved organization that investigates payment data breaches

PFIs are organizations approved by the PCI SSC to conduct forensic investigations of payment card data compromises, determining breach scope, timeline, and root cause.

What notification requirements apply after a payment data breach?

Answer: Notify payment brands, acquiring bank, and affected individuals as required by applicable breach notification laws

Breach notification requirements vary by jurisdiction but generally require notifying card brands, acquiring banks, affected individuals, and potentially state attorneys general within specified timeframes.

How often should the incident response plan be tested?

Answer: At least annually through tabletop exercises or simulated incidents

PCI DSS requires annual testing of the incident response plan to ensure team members understand their roles and the plan effectively addresses potential breach scenarios.

What is the role of log monitoring in detecting security incidents?

Answer: Continuous review of system, network, and application logs to identify suspicious activity indicating a potential breach

Log monitoring involves collecting, centralizing, and analyzing logs from firewalls, IDS/IPS, servers, and applications to detect anomalous activity that may indicate an attack or breach.