Project Management & Execution Flashcards

How often must the incident response plan be reviewed and tested under Requirement 12.10.2?

Answer: At least once every 12 months

The incident response plan must be reviewed, updated, and tested at least annually.

What is the minimum security awareness training frequency under v4.0?

Answer: Upon hire and at least once every 12 months

Requirement 12.6.1/12.6.3 requires awareness training on hire and at least annually.

What is the audit log retention requirement under Requirement 10.5.1?

Answer: Retain 12 months, with at least the most recent 3 months immediately available

Logs must be retained 12 months with the latest three months immediately available for analysis.

After a significant change such as a new payment channel, what should the PCI project team do?

Answer: Confirm scope impact and verify applicable PCI DSS requirements are in place

Significant changes trigger scope reconfirmation and verification of applicable requirements.

Which role is required by Requirement 12.4.1 for service providers?

Answer: Executive management establishes responsibility for protection of account data and the PCI DSS compliance program

Service providers must have executive management formally responsible for the compliance program.

What is the goal of Requirement 6.4.3 for payment pages?

Answer: Manage, authorize, and inventory all scripts loaded and executed in the consumer's browser

Requirement 6.4.3 requires scripts on payment pages to be authorized, justified, and inventoried.

What does Requirement 11.6.1 require for payment pages?

Answer: A change- and tamper-detection mechanism for HTTP headers and payment page content

11.6.1 requires detecting unauthorized modification of payment page content and HTTP headers, evaluated at least weekly or per TRA.