Project Management & Execution Flashcards

How often must external vulnerability scans be performed by a PCI SSC Approved Scanning Vendor (ASV)?

Answer: At least once every three months

Requirement 11.3.2 requires ASV external scans at least once every three months.

How often must internal vulnerability scans be performed under Requirement 11.3.1?

Answer: At least once every three months

Internal scans are required at least quarterly, with rescans until high-risk vulnerabilities are resolved.

How frequently must internal and external penetration testing be performed?

Answer: At least once every 12 months and after significant changes

Requirements 11.4.2 and 11.4.3 call for annual testing and testing after significant changes.

Which merchants generally require an annual onsite assessment resulting in a ROC?

Answer: Level 1 merchants (typically over 6 million Visa transactions annually)

Level 1 merchants undergo annual onsite assessments by a QSA or qualified internal assessor.

Which merchant is generally eligible for SAQ A?

Answer: A card-not-present merchant that fully outsources all payment processing to PCI compliant third parties

SAQ A fits card-not-present merchants with all account data functions fully outsourced and no electronic storage.

What is the Attestation of Compliance (AOC)?

Answer: A signed declaration of assessment results submitted to the requesting acquirer or card brand

The AOC summarizes validation results and is signed by an authorized officer of the entity.

In a PCI DSS assessment, what is the purpose of sampling?

Answer: To test representative subsets of system components when assessing large environments, with justification

Assessors may sample representative components, justified by standardization and controls consistency.