Project Management & Execution Flashcards

At the start of a PCI DSS project, which activity must come first to define the assessment boundary?

Answer: Identifying all locations and flows where account data is stored, processed, or transmitted

Scope is defined by locating the cardholder data environment and all connected or security-impacting systems.

How often must the PCI DSS scope be documented and confirmed by the entity under v4.0 (and upon significant change)?

Answer: At least every 12 months

Requirement 12.5.2 requires scope confirmation at least every 12 months and after significant changes.

In v4.0, how often must service providers re-confirm PCI DSS scope?

Answer: Every 6 months

Requirement 12.5.2.1 requires service providers to confirm scope at least every six months and after significant change.

Which document best demonstrates where account data moves across systems and networks during scoping?

Answer: Accurate data-flow diagram

Requirement 1.2.4 requires an accurate data-flow diagram showing all account data flows.

A merchant uses a third-party service provider (TPSP) that handles card data. What must be in place under Requirement 12.8.2?

Answer: A written agreement with acknowledgment of the TPSP's responsibility for account data security

Written agreements must acknowledge the TPSP's responsibility for the security of account data it handles.

What does a PCI DSS responsibility matrix document for TPSP relationships?

Answer: Which PCI DSS requirements are managed by the entity, the TPSP, or shared

Requirement 12.8.5 requires information on which requirements each TPSP manages versus the entity.

During scoping, a team finds the full track data stored after authorization in a log file. What is the correct project action?

Answer: Remove it and fix the source, since sensitive authentication data must not be retained after authorization

Requirement 3.3.1 prohibits storing sensitive authentication data after authorization, even if encrypted.